In 2017, ransomware attacks clearly dominated the cybersecurity landscape. WannaCry, Petya, Not Petya, Adylkuzz, Bad Rabbit, Cerber, etc. are just a few names that did the rounds in the last year. Lucrative payments is one of the most prominent reasons which has lured in many attackers to launch multiple ransomware campaigns in the last couple of decades. Though we are yet to see a major ransomware attack this year, activities of cyberspace are unpredictable.

PALM BEACH GARDENS, Fla.--(BUSINESS WIRE)--Companies aren’t very confident in their ability to detect, respond to and remediate ransomware attacks, according to the 2017 Ransomware Report, sponsored by user behavior analytics and activity monitoring company Veriato and 13 other companies and conducted by Crowd Research Partners.

A new strain of the Petya ransomware started propagating on June 27, 2017, infecting many organizations. Similar to WannaCry, Petya Ransomware uses the Eternal Blue exploit to propagate itself. Petya is taking down corporate networks that run mainly on Microsoft Windows software. It has already hit most Government applications in Ukraine as well as major companies in Europe including advertising agency WPP and law firm DLA Piper.

Friday May 12th will be the day we remember the start of the mayhem caused by ‘WannaCry’, the most successful ransomware infection in history. Since Friday, Security teams have been running around with their heads on fire trying to get ahead of the infection and to understand the malware’s capabilities. In the process, a lot new sales lead ransomware experts seem to have risen from the depths and have confused the situation further.

The recent WannaCry ransomware attack, that has hit over 100 countries, would have been much larger had it not been for the early actions of both a UK cybersecurity researcher who blogs for Malwaretech and two Proofpoint researchers. In this attack, a powerful Microsoft exploit turned into a very nasty worm. As part of their initial effort, the researchers found and sinkholed a domain name hardcoded in the malware, for $10.69 during the early stages of the attack.

BianLian is a threat actor known for operating the BianLian ransomware. Initially, it emerged as an Android banking trojan back in 2019. Much like the traditional Chinese art of “face-changing” from which it takes its name, BianLian has displayed impressive adaptability. It has transitioned its activities to primarily focus on ransomware attacks, first appearing as a ransomware strain in July 2022.