It is expected to see LockBit RaaS use grow because it doesn’t require the attacker to be skilled and it can spread to many computers very quickly. In this particular case, an outdated VPN was found to be the primary avenue of assault, and the attackers logged on by guessing the password for an administrator account. Because the attacker accessed systems through a legitimate administrator account, no anti-virus or firewall solution would have prevented the initial intrusion. Only an Endpoint Detection and Response (EDR) solution that detects unusual behavior could have helped security analysts recognize this attack, and only if the security team was monitoring at 1 AM could they have responded quickly to stop this attack.

Organizations are recommended to keep all of their systems and remote access solutions as up-to-date as possible. If a software package is no longer supported, then it should be replaced with a newer service. In any ransomware attack, the primary recovery tool is via a clean and secure backup, provided the attackers did not destroy the backups. The 3-2-1 backup rule should be applied: three copies of the data on two separate devices with one of them being offsite. This attack happened at 1 AM, when most companies do not staff the IT or security help desk. A service such as the Binary Defense Security Operations Center can provide around the clock detection and defense of a company’s endpoints. Binary Defense’s Managed Detection and Response (MDR) solution generates many different alarms for the behavior of LockBit, and the Binary Defense analysts on duty would respond quickly to stop the spread of the ransomware at any time of day or night.

To read more: https://www.bleepingcomputer.com/news/security/lockbit-ransomware-self-spreads-to-quickly-encrypt-225-systems/