They are successful in doing this because the data these organizations exfiltrate are business sensitive to their business owners, and in some instances, impact the operations of those businesses that encourage ransom payment, according to Laudanski.
In an analysis of ransomware data over the last three years and isolating incidents that directly involved compromise of SAP-based data, the researchers were able to conclude that, since 2021, there has been a 400% growth in the number of attacks.
The leading ransomware groups involved in such attacks included Conti, Quantum, LockBit, Blackcat, HIVE, REvil, and Netwalker.
Additionally, a few of the attacks targeting SAP systems data were also found to have been a part of a state-sponsored campaign. “One of the examples of Threat Actors known to target SAP Applications is APT10, known to be associated with Chinese state backing,” Perez-Etchegoyen added.
Heightened dark web chatter
According to the research, conversations on SAP vulnerabilities and exploits have increased by 490% across the open, deep, and dark web from 2021 to 2023. The conversations primarily focused on how to exploit the vulnerabilities, guidance for the execution of exploitation for certain victims, and monetizing SAP compromises.
Additionally, the researchers found that the price for remote code execution (RCE) attacks for SAP applications increased by 400% from 2020 to 2023.
