Hoffman pointed out that a typical Fortune 1000 company has at least 100 times more web applications — many of which are one-off business apps quickly written using platforms like ColdFusion, since it was a popular and easy-to-use web framework. These apps tend to slip through the cracks, remain unpatched, and ultimately become an entry point for attackers, Hoffman added.
Darren Guccione, co-founder and CEO at Keeper Security, said the Ghost ransomware campaign highlights the persistent reality that adversaries exploit known vulnerabilities faster than many organizations can patch them, which reinforces the critical need for proactive risk management — security leaders must ensure that software, firmware and identity systems are continuously updated and hardened against exploitation.“This is a global-scale threat, affecting critical infrastructure, healthcare, government and SMBs alike,” said Guccione. “Security leaders must act decisively to reduce their attack surface, invest in zero-trust architectures and deploy robust endpoint and identity security controls to mitigate ransomware risks before they escalate into business-disrupting incidents.”Jim Walter, senior threat researcher at SentinelOne, said the FBI-CISA advisory highlights an ongoing trend in the world of ransomware-extortion actors. Walter said these financially motivated groups are widely scattered, and use whatever functional tools are available to accomplish their profit goals.“None of the TTPs leveraged by Ghost are novel, but their methods are effective,” said Walter. “They use and exploit what works and leads to profit, and as long as new flaws continue to be discovered in these edge devices-appliances and IAM platforms, this type of activity will continue. Prevention is critical and key here. Following CISA’s guidance on backups/BCP/DRP, patching, segmentation and education go a long way to limiting the effect of these attacks.”