---
title: Three Trends Making Ransomware Attacks More Dangerous
description: Ransomware attacks are becoming more dangerous. Three of the biggest reasons are the shift from one target to many, human-operated ransomware, and the rise of spearphishing.
image: https://blog.morphisec.com/hubfs/Three%20Ransomware%20Trends.png
---

Recent Webinar: Building an Adaptive Cyber Resilient Cloud

![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa)

![close](https://www.morphisec.com/hubfs/close.svg)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)

[![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

[![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com)

![search_icon](https://www.morphisec.com/hubfs/search_icon.svg)

- ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360)
- [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3)

Cybersecurity Blog

Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security

# Three Trends Making Ransomware Attacks More Dangerous

Posted by [Matthew Delman](https://1534169.hs-sites.com/author/matthew-delman) on May 13, 2021

Find me on:

[LinkedIn](https://www.linkedin.com/in/matthewdelman/) [Twitter ](https://twitter.com/nerdymarketr)

- [Tweet](https://twitter.com/share)

![Man worrying about ransomware trends](https://blog.morphisec.com/hubfs/Three%20Ransomware%20Trends.png)

Has there ever been a threat to your business risk quite like a [ransomware attack](https://www.morphisec.com/ransomware-protection)? One that strikes without warning to cripple a company almost instantly; one that afflicts organizations regardless of their size, industry, or importance; or one that appears so unstoppable even to the well-prepared?

Nonexistent 30 years ago, ransomware has become an existential threat to literally every office in the world. There has arguably never been a threat that exists on this scale. Most alarming of all: ransomware is getting worse. 

Recent events demonstrate how diabolical the ransomware threat has become. Attacks increased by [715% in 2020](https://cyberflorida.org/covid/bitfender/) as adversaries piggybacked off the disruption of the Covid-19 pandemic to catch victims with their guard down. In addition to being more aggressive, threat actors were more merciless about whom they targeted: A patient in a German hospital [died](https://www.bbc.com/news/technology-54204356) after the equipment keeping him alive was disabled by ransomware, and a California university paid over [$1 million in ransom](https://www.insidehighered.com/quicktakes/2020/07/02/ucsf-pays-1-million-ransom-hackers) to get its IT back online. [The Colonial Pipeline attack](https://www.bleepingcomputer.com/news/security/us-declares-state-of-emergency-after-ransomware-hits-largest-pipeline/) showcased the numerous vulnerabilities in the US energy infrastructure, in addition to untold effects on the country’s economy. These are just three of the many abhorrent examples of adversaries picking the most sensitive targets to maximize the likelihood of payment. 

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/0690f89c-00ec-4d99-a304-a03be510968d.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/0690f89c-00ec-4d99-a304-a03be510968d)

That tactic appears to be working considering that ransomware payments rose by [100% in 2020](https://purplesec.us/resources/cyber-security-statistics/ransomware/#:~:text=Ransomware%20costs%20are%20forecast%20to%20reach%20a%20record%20$20%20Billion%20by%202021.&text=The%20average%20cost%20of%20ransom%20per%20incident%20in%202020.&text=The%20average%20cost%20of%20a%20ransomware%20attack%20on%20businesses%20in%202019.). It shows no signs of stopping; an Apple supplier was recently hit with a [$50 million ransom](https://www.bloomberg.com/news/articles/2021-04-21/apple-targeted-in-50-million-ransomware-hack-of-supplier-quanta) demand. With that, cybercriminals have tied the record for the largest ransom demand in history. If ransomware was worrisome before, it has taken on a truly terrifying character now. And no organization can consider itself immune. 

However, that doesn’t mean everyone shares the same risk of a successful ransomware attack. In fact, it’s that attitude – one that sees ransomware as inevitable and unstoppable – that puts companies in the most vulnerable position. Instead of updating their security strategy to keep pace with the evolution of ransomware, they assume the situation is hopeless. 

It’s not. You can fight back, but you must understand what you’re up against. With that in mind, consider four ways ransomware is evolving and what that means for your security strategy:

## Ransomware Shifts From One Target to Many

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/c7b2a274-35d7-4a6f-893f-4c3314722220.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/c7b2a274-35d7-4a6f-893f-4c3314722220)The explosion of attacks we saw in 2020 looked a lot like the attacks from years past, at least in their early stages. Then, attackers would use a phishing attack or exploit some known/unknown vulnerability to gain entry to an IT network. After this initial breach, there was a gradual introduction to automatic propagation methods. But, today, a single target isn’t enough anymore. Eventually, there would be a shift to human operable ransomware that disregards small networks.

Today’s ransomware attacks move laterally through organizations by hunting for high privilege credentials and exfiltrating information. Their goal is to hit as many machines as possible – i.e., maximize the damage. More than just locking up the machines, they’re trying to steal data they can use for various nefarious purposes on top of demanding a ransom. The difference between this form of ransomware and earlier forms is the difference between an attack and an onslaught.  

Preventing these lateral movements – not just hoping to detect them – must be a priority for the security team. Otherwise, a single ransomware attack could cut so deeply that it’s impossible to recover.

## Human-Operated Ransomware Attacks Rise to Prominence

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/1cd620ad-96af-4123-a82e-9f8882b4454a.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/1cd620ad-96af-4123-a82e-9f8882b4454a)For all their effectiveness, ransomware attacks are simple. They follow an assigned pathway and fail if they encounter unexpected resistance along the way. With the advent of *human-operated ransomware*, however, the attacks have gotten much more sophisticated. 

Instead of relying on malware to drive the attack, human-operated ransomware has an operator at the wheel, guiding it around resistance, through safety measures, and towards the most valuable target possible. These attacks are more persistent and, not surprisingly, far more effective and destructive. 

How do you outsmart a human-operated attack? By shifting to a zero-trust framework; a preventive strategy saves time, money, and your reputation. 

## Spear Phishing Campaigns Replace Mass Phishing

Spear phishing campaigns have become the preferred delivery method for ransomware. Adversaries will pick an intended target, then customize an email message to sound as believable as possible. This sharply contrasts with regular phishing, which involves a broad-strokes approach that when sending bulk emails to massive lists of naive contacts.  Unsuspecting users will then click a link or download an attachment that results in malware infection. The FBI [issued a warning](https://securityintelligence.com/fbi-warns-increase-spear-phishing-attacks/) about these campaigns in July 2020, when their frequency was 67% higher than at the start of the year. Spear phishing campaigns are also getting more sophisticated: with domain spoofing techniques, cybercriminals send spear-phishing emails from addresses that look *exactly *like authorized senders. 

This can only mean one thing: more attacks that successfully breach the perimeter. And, as the previous three points emphasize, attacks can deal devastating amounts of damage once inside. Ransomware looks more formidable than ever. 

## How to Protect Your Organization

Faced with this threat, a cybersecurity strategy built around AV and EDR is doomed to fail. By the time these defenses kick in, it’s already too late. The best advice comes down to this: evolve or die. Prevention is the *only *defense that works. This means adopting a proactive cybersecurity strategy focused on zero trust, reducing the attack surface, and, of course, [moving target defense](https://www.morphisec.com/). 

[![Contact Morphisec for more information](https://no-cache.hubspot.com/cta/default/1534169/eb202d00-4a51-4d88-9f1f-966429c05359.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/eb202d00-4a51-4d88-9f1f-966429c05359)

### Subscribe to our blog

Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates.

[![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4)

### Search Our Site

### Recent Posts

### Posts by Tag

- [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense)
- [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research)
- [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news)
- [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs)
- [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news)
- [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management)
- [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth)
- [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware)
- [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security)
- [Gartner (10)](https://1534169.hs-sites.com/topic/gartner)
- [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem)
- [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft)
- [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks)
- [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity)
- [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense)
- [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity)
- [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security)
- [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence)
- [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity)
- [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware)
- [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management)
- [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers)

[See all](https://1534169.hs-sites.com/three-trends-ransomware-attacks-more-dangerous#)

- [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec)
- [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec)
- [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw)

© 2026 Morphisec Ltd. | All rights reserved

![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Matthew Delman",
    "url" : "https://1534169.hs-sites.com/author/matthew-delman"
  },
  "dateModified" : "2021-06-07T11:13:37.314Z",
  "datePublished" : "2021-05-13T13:00:00.000Z",
  "headline" : "Three Trends Making Ransomware Attacks More Dangerous",
  "image" : [ "https://blog.morphisec.com/hubfs/Three%20Ransomware%20Trends.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://1534169.hs-sites.com/three-trends-ransomware-attacks-more-dangerous",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png"
    },
    "name" : "Morphisec"
  }
}
```