Thread by @Chi_from_afar

🧵The latest Threat Landscape Update from @RelativityHQ’s Calder7 security team details a particularly concerning new trend in #ransomware, which combines Ransomware-as-a-Service (RAAS) with employee-led Insider Threats. #cybersecurity #infosec #hackers #SundayReads (1/7)

RAAS has been around since early 2020 and has quickly become the leading vector for deploying #ransomware. The newest iteration of it is enticing employees to intentionally deploy #ransomware w/i their own org. A particularly nasty case of insider threat (2/7)

Reported by @briankrebs, threat actors trying this technique are using the #Demonware strain and are targeting networks of interest in the U.S., Canada, Australia, U.K., and for RDP, VPN, - corporate email access specifically (3/7)

While insider threats are nothing new, adding #ransomware to the equation broadens the threat landscape for these types of attacks and could lead to considerable consequences for orgs not up-to-date on the latest threats. It’s also a risky move for these threat actors (4/7)

Particularly concerning is the fact that any employee in any org can be enticed to deploy #ransomware on their personal comp or any server they have access to, giving these #ransomware operators everything they need to bypass secure networks and well-trained employees (5/7)

While insider threats are particularly hard to manage, here are three things you can do to mitigate risk:
1⃣Strong background checks
2⃣Continuous feedback in the employee review process
3⃣Being alert to warning signs or changes in employee behavior (6/7)

Additionally, implementing Separation of Duties, the security principle of Least Privilege, and properly segmenting and protecting your infrastructure are all ways to minimize the attack vectors of insider threats and this RAAS strain. #cybersecurity #infosec #hackers /fin (7/7)