IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Ransomware attacks most likely to strike after-hours

Researchers identify patterns of commonality, including attack vector, dwell time and the time of strike

Three-quarters of ransomware attacks are launched during the weekend or after work on a weekday, as attackers aim to maximise the potential for devastation and slow down any attempts at mitigation.

Just under half of all ransomware attacks, 49%, are launched on weekdays after 6pm while just 24% occur during work hours and 27% on weekends, according to findings by Fire Eye

Related Resource

The essential guide to cloud-based backup and disaster recovery

Support business continuity by building a holistic emergency plan

Download now

The most common hour for ransomware attacks to strike organisations is 11pm, at a time where workers least likely to be able to respond instantaneously.

Organisations from various sectors have been struck with ransomware attacks on an increasing basis in recent months and years, with attacks on UK businesses soaring 195% in the first half of 2019, for example.

“Ransomware is a remote, digital shakedown. It is disruptive and expensive, and it affects all kinds of organizations, from cutting edge space technology firms, to the wool industry, to industrial environments,” said Fire Eye’s intelligent analysis manager Kelli Vanderlee. 

“Infections have forced hospitals to turn away patients and law enforcement to drop cases against drug dealers.”

High profile examples include the devastating Travelex disruption, as well as institutions in several US states, including Louisiana, and towns in Florida, and other states.

This breed of attack, according to an examination of dozens of incident response investigations between 2017 and 2019, share several common characteristics, including attack vector, dwell time, and time and day of deployment. 

There were several initial infection vectors spotted across multiple incidents, with remote access and remote desktop protocol (RDP) the most frequently observed. Other methods include phishing with a link or attachment and drive-by-download. 

Another observation was that attackers normally leave at least three days between the first sign of malicious activity and deploying ransomware. In 75% of cases, this period is three days until the payload is deployed.

Among the key findings was that few attacks are launched during work hours, relative to after-work hours and weekends.

“Some attackers possibly intentionally deploy ransomware after hours, on weekends, or during holidays, to maximize the potential effectiveness of the operation on the assumption that any remediation efforts will be implemented more slowly than they would be during normal work hours,” Vanderlee continued.

“In other cases, attackers linked ransomware deployment to user actions. For example, in 2019 incidents at retail and professional services firms, attackers created an Active Directory Group Policy Object to trigger ransomware execution based on user log on and log off.”

Organisations seeking to mitigate or prevent ransomware infections have been given an array of measures they can take, many of which are now deemed common sense such as implementing multi-factor authentication (MFA).

Fire Eye has also urged organisations to establish emergency plans to ensure after-hours coverage is available to respond within a set time period in case of an emergency. After-hours escalation plans should also include redundant means to contact stakeholders, and 24-hour emergency contact information for any relevant third-party vendors.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021
US and Israel join forces to fight ransomware
ransomware

US and Israel join forces to fight ransomware

15 Nov 2021

Most Popular

Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022
Macmillan Publishers hit by apparent cyber attack as systems are forced offline
Security

Macmillan Publishers hit by apparent cyber attack as systems are forced offline

30 Jun 2022
Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022