Skip to content

ESET Threat Report: AI-driven attacks on the rise; NFC threats increase and evolve in sophistication

ESET Research has released its H2 2025 Threat Report with statistics from June through November 2025.
NFC threats have continued to evolve in scale and sophistication, with several notable upgrades and new malicious campaigns seen in H2 2025.
ESET observed several improvements in scams including higher-quality deepfakes, signs of AI-generated phishing sites, and short-lived ad campaigns to avoid detection.
Even though Lumma Stealer managed to come back after the May 2025 disruption, its detections declined by 86% in H2 2025.

BRATISLAVA — December 16, 2025 — ESET Research has released its latest Threat Report, which summarizes threat landscape trends seen in ESET telemetry and from the perspective of both ESET threat detection and research experts, from June through November 2025.  AI-powered malware moved from theory to reality in H2 2025, as ESET discovered PromptLock – the first known AI-driven ransomware, capable of generating malicious scripts on the fly. While AI is still mainly used for crafting convincing phishing and scam content, PromptLock – and the handful of other AI-driven threats identified to this day – signal a new era of threats.

“Fraudsters behind the Nomani investment scams have also refined their techniques – we have observed higher-quality deepfakes, signs of AI-generated phishing sites, and increasingly short-lived ad campaigns to avoid detection,” says Jiří Kropáč, Director of ESET Threat Prevention Labs. In ESET telemetry, detections of Nomani scams grew 62% year-over-year, with the trend declining slightly in H2 2025. Nomani scams have recently been expanding from Meta to other platforms, including YouTube.

On the ransomware scene, victim numbers surpassed 2024 totals well before year’s end, with ESET Research projections pointing to a 40% year-over-year increase. Akira and Qilin now dominate the ransomware-as-a-service market, while low-profile newcomer Warlock introduced innovative evasion techniques. EDR killers continued to proliferate, highlighting that endpoint detection and response tools remain a significant obstacle for ransomware operators.

On the mobile platform, NFC threats continued to grow in scale and sophistication, with an 87% increase in ESET telemetry and several notable upgrades and campaigns observed in H2 2025. NGate  – a pioneer among NFC threats, first discovered by ESET– received an upgrade in the form of contact stealing, likely laying the groundwork for future attacks. RatOn, entirely new malware on the NFC fraud scene, brought a rare fusion of remote access trojan (RAT) capabilities and NFC relay attacks, showing cybercriminals’ determination to pursue new attack avenues. RatOn was distributed through fake Google Play pages and ads mimicking an adult version of TikTok, and a digital bank ID service.  PhantomCard – new NGate-based malware adapted to the Brazilian market – was seen in multiple campaigns in Brazil in H2 2025.

Furthermore, after its global disruption in May, the Lumma Stealer infostealer managed to briefly resurface – twice – but its glory days are most likely over. Detections plummeted by 86% in H2 2025 compared to the first half of the year, and a significant distribution vector of Lumma Stealer – the HTML/FakeCaptcha trojan, used in ClickFix attacks – nearly vanished from ESET telemetry.

Meanwhile, CloudEyE, also known as GuLoader, surged into prominence, skyrocketing almost thirtyfold according to ESET telemetry. Distributed via malicious email campaigns, this malware-as-a-service downloader and cryptor is used to deploy other malware, including ransomware, as well as infostealer juggernauts such as Rescoms, Formbook, and Agent Tesla. Poland was most affected by this threat, with 32% of CloudEyE attack attempts in H2 2025 detected here.

For more information, check out the ESET Threat Report H2 2025 on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

 

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

FSLogix Deep Dive: The Ultimate VDI Configuration Guide (2025)

As a solution engineer who has been in the trenches with VDI and Terminal Servers since the days of Windows NT 4.0, I’ve seen profile management evolve from a chronic pain point to a solved problem. The solution? FSLogix.

Before Microsoft acquired it, FSLogix was the “secret weapon” that VDI architects used to fix the unfixable. Today, it’s the default, non-negotiable standard for any modern VDI or multi-session Windows deployment, especially Azure Virtual Desktop (AVD).

This deep-dive guide will cover its uses, advanced configurations, and best practices for building a resilient, high-performance deployment, including specific GPO settings for clustered environments.

The FSLogix Toolkit: What It Is and Why You Need It

At its core, FSLogix is a set of tools designed to decouple the user profile from the Windows operating system. In non-persistent VDI, where a user’s virtual machine is destroyed or reset at logoff, this is essential.

Instead of copying a roaming profile (which is slow, fragile, and a primary cause of slow logins), FSLogix mounts a user’s profile, stored in a VHDX (virtual disk) file on a network share, directly into the OS at login. It’s instant, seamless, and transparent to Windows.

The FSLogix suite includes:

  • Profile Container: This is the main component. It captures the entire user profile (C:\Users\<username>) and redirects it to the VHDX. This includes all app settings, registry keys (NTUSER.dat), and user data.
  • Office Container (ODFC): This component only redirects the data for Microsoft 365 apps (Outlook cache .ost, Teams data, OneDrive cache, etc.).
  • Application Masking: A powerful tool that allows you to “hide” applications, drivers, or fonts from specific users, even if they are installed on the base image. This dramatically simplifies “golden image” management.
  • Java Redirection: A niche component to manage multiple versions of Java for specific applications.

The Great Debate: Profile Container vs. ODFC

This is the most common point of confusion. Let’s be clear:

Best Practice: In 99% of new deployments, you should use only the Profile Container.

Do NOT use a separate Profile Container and a separate Office Container. This is a common-sense myth that adds complexity, doubles the VHDX files to manage, and increases points of failure.

The Profile Container already captures all Office data. The only reason ODFC exists as a separate component is for legacy environments that already have another profile solution (like Citrix UPM or VMware DEM) and just want to add FSLogix to fix Office performance.

In your Group Policy (GPO) or registry settings, you simply configure the Profile Container Enabled = 1 and ensure Office data is included.

FSLogix Cluster & GPO Configuration

FSLogix Clusters are fundamental for ensuring user profile persistence. In this model, each “cluster node” is typically a high-availability file server (like a Windows Server 2022 Scale-Out File Server) that provides dedicated, fault-tolerant storage for the dynamic profile VHDX files.

This guarantees session consistency across different VDI hosts. Configuration is applied and managed through GPOs (Group Policy Objects), ensuring standardization and centralized governance throughout the environment. Each VDI instance uses the FSLogix Agent to connect to the cluster share over SMB (port 445).

FSLogix Configuration Parameters (via GPO)

Here is a baseline set of GPO settings for a production environment. These settings are applied via GPO, which writes the corresponding values to the registry.

Find the detailed parameters on The following link: FSLogix Cluster Sizing and Configuration

Here is a copy-ready deep-dive on FSLogix, integrating your specific configuration parameters.

Advanced Optimization & Resilience

Getting the GPOs set is step one. Making it fly and never fail is step two.

1. Optimization: The Redirections.xml File

This is the most powerful optimization tool. The Redirections.xml file allows you to exclude “junk” data from being saved in the user’s profile container. By excluding data, you keep the VHDX small, logins fast, and network traffic low.

A good Redirections.xml file should exclude:

  • Browser caches (Chrome, Edge, Firefox)
  • Temp folders
  • Windows Search and Update logs
  • Teams cache (FSLogix now handles Teams data very well natively, but some still exclude the media-stack folder).

You place this file on your network share and point to it in your GPO using the RedirectionXMLSourceFolder setting.

2. Resilience: Antivirus Exclusions (Non-Negotiable)

This is the #1 cause of profile corruption and performance issues. Your VDI session hosts must exclude the FSLogix processes and file locations from real-time antivirus scanning.

Process Exclusions:

  • frxsvc.exe
  • frxshell.exe
  • frxccd.exe (if using Cloud Cache)

File/Directory Exclusions:

  • %ProgramFiles%\FSLogix
  • %APDATA%\FSLogix
  • The network share(s) where your VHDX files are stored.
  • File Extensions: .vhd, .vhdx

3. High Availability: Cloud Cache vs. Storage-Level HA

You have two main ways to achieve high availability.

Storage-Level HA (Your “Cluster” Model):

This is the easiest and most reliable method. You use a storage solution that is already highly available (like a Windows Server 2022 Scale-Out File Server, a cluster, or Azure Files ZRS). You then set a single path in VHDLocations. If a storage node fails, the storage cluster handles it transparently.

FSLogix Cloud Cache (Recommended for DR):

Cloud Cache is the FSLogix-native HA solution. You configure multiple storage locations (e.g., one on-prem, one in Azure). FSLogix writes to a local cache on the VDI host first, then asynchronously replicates changes to all storage locations. This is more complex but provides true active-active access and disaster recovery.

4. Network Settings: The Unsung Hero

Your VDI session hosts and your file server must be as close as possible.

  • Same Datacenter/Region: Never route core FSLogix traffic over a WAN.
  • Same Subnet (Zero Latency): FSLogix traffic (SMB/445) is highly sensitive to latency. Place your VDI session hosts (clients) and your FSLogix file share on the same subnet. This eliminates any firewall, router, or traffic inspection device from the data path. Even a tiny delay from a firewall policy check can cause login slowdowns and profile hangs.
  • Enable SMB Multichannel: Allows Windows to use multiple network connections to your file share, increasing throughput and resiliency.

Expert Tips: FSLogix with Thinfinity VDI on OCI

This is a great, modern stack. Thinfinity is a VDI broker that is “infrastructure agnostic,” meaning it can manage session hosts anywhere—including OCI. FSLogix is the agent on those OCI session hosts.

Here’s how to make them work together perfectly.

  • Thinfinity and FSLogix are Partners: Thinfinity manages the connection, and FSLogix manages the profile inside the session. They don’t conflict; they complement each other. The Thinfinity non-persistent/multi-session model requires a solution like FSLogix.
  • Authentication is King (Active Directory): FSLogix requires Active Directory. Your OCI-based VDI session hosts must be joined to an Active Directory domain. This means you must have Domain Controllers running on OCI Compute instances or have a line-of-sight connection (via OCI FastConnect or VPN) back to your on-prem AD.
  • Storage on OCI: Your best bet is OCI File Storage. It’s a managed, zonal, high-performance file service that supports the SMB protocol.
    1. Create a File System in OCI.
    2. Create a Mount Target in the same VCN and Availability Domain as your Thinfinity session hosts.
    3. Configure the VCN Security Lists (firewall) to allow SMB (TCP/445) traffic only from your session host subnet to the File Storage subnet.
  • OCI Network Latency: The “same AD” principle is critical in OCI. OCI’s Availability Domains are physically separate datacenters. While cross-AD latency is low, for the absolute best performance, your session host pools and your OCI File Storage mount target should reside in the same Availability Domain.

Conclusion: It Is Not an Add-On

FSLogix is not merely a “feature” or an “add-on” for a VDI deployment; it is the cornerstone of the modern user experience. It has single-handedly solved the decades-old problem of profile management, transforming non-persistent VDI from a compromise into a high-performance, user-centric solution.

However, as this guide has demonstrated, a successful FSLogix deployment is an exercise in precision. The difference between a high-performance environment and a support-ticket nightmare lies not in if you use FSLogix, but how.

Success is built on a foundation of three pillars:

  • Low-Latency, High-Availability Storage: Your profile solution is only as reliable as the file cluster it runs on.
  • An Unobstructed Network Path: Placing VDI hosts and storage on the same subnet, free from inspection, is the single most effective way to guarantee fast logins.
  • Intelligent Configuration: From GPOs to Redirections.xml, optimization is about what you exclude as much as what you include.

When architected correctly—with the same engineering rigor you apply to your VDI hosts and network—FSLogix becomes the silent, invisible hero of your virtual desktop infrastructure. It delivers the one thing that matters most: a user experience that is fast, resilient, and never gets in the way.

About Cybele Software Inc.
We help organizations extend the life and value of their software. Whether they are looking to improve and empower remote work or turn their business-critical legacy apps into modern SaaS, our software enables customers to focus on what’s most important: expanding and evolving their business.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

EasyVista Unveils 2025.3 Platform Release, Building a Solid Data Foundation for Next-Gen AI in ITSM

EasyVista today announced the third and final major platform update for the year, the 2025.3 release of its ITSM Platform. This update represents the conclusion of a focused, multi-release strategy designed to deliver a unified, high-quality, data-driven foundation essential for leveraging AI across all IT operations. With 2025.3, EasyVista continues to integrate intelligence into routine workflows while ensuring the operational robustness needed for dependable AI adoption.

Addressing the AI Readiness Gap

The release comes as companies globally ramp up their AI and automation efforts. EasyVista’s own research reveals that while AI rollout is a top three IT priority for 2026, a significant disparity exists: only 12.4% of organizations report having a mature ITSM framework. This highlights a growing disconnect between high ambition and actual operational readiness.

By stabilizing core operations, ensuring data standardization, and enhancing knowledge quality, EasyVista’s 2025 releases (which collectively delivered over 100 features) directly tackle this gap, enabling AI to function effectively without introducing undue complexity or risk.

Key Functional Enhancements in 2025.3

The final release of the year focuses on improving agent experience and foundational AI enablement:

  • Contextual AI Recommendations: Delivering more precise AI suggestions surfaced directly within incident resolution workflows to boost agent efficiency.
  • Streamlined Global Support: Automated ticket summarization now features integrated translation capabilities, accelerating international service delivery.
  • Microsoft Copilot Chat Integration: Introducing the EV chatbot for Microsoft Copilot, allowing ticket management and interaction directly through the Copilot chat interface.
  • Next-Gen Knowledge Management: Launching an AI-optimized, node-based model for smarter knowledge handling and retrieval.
  • Customizable Workspaces: Expanded Home Canvas configuration options for highly personalized agent workspace layouts.

Strategic Commentary: Practical AI Adoption

“This release serves as the centerpiece of our 2025 strategy, solidifying the data and knowledge infrastructure required for AI to deliver true value,” stated Loic Besnard, Chief Product Officer, EasyVista. “Our customers require AI that is practical, responsible, and fully integrated into their actual work processes. With 2025.3, we are providing AI that instantly enhances agent performance while constructing the foundational backbone for future, autonomous automation.”

The cumulative effect of the 2025 releases prepares organizations for the next evolution: AI that extends beyond analysis and recommendation to confidently and reliably execute actions across the entire IT ecosystem. The upgrade to 2025.3 is now immediately available for all EasyVista ITSM Platform customers.

 

Request a demo or trial

About EasyVista  
EasyVista is a leading IT software provider delivering comprehensive IT solutions, including service management, remote support, IT monitoring, and self-healing technologies. We empower companies to embrace a customer-focused, proactive, and predictive approach to IT service, support, and operations. EasyVista is dedicated to understanding and exceeding customer expectations, ensuring seamless and superior IT experiences. Today, EasyVista supports over 3,000 companies worldwide in accelerating digital transformation, enhancing employee productivity, reducing operating costs, and boosting satisfaction for both employees and customers across various industries, including financial services, healthcare, education, and manufacturing.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

How Role-Based Access Controls Empower MSPs with Flexible Security

In the MSP world, applying identical access security policies—the same password length, rotation schedule, and MFA requirements—to everyone in a client’s organization often creates more problems than it solves. This forces high-risk IT staff to follow the same basic policies as low-risk frontline users. The inevitable result: policies that are too weak for critical roles or so burdensome that standard users seek workarounds, resulting in administrative friction and dangerous security gaps.

What is Role-Based Access Control (RBAC)?

Role-Based Access Control (RBAC) defines user access based on job functions rather than individual identity. Instead of manually granting permissions to each employee, administrators assign personnel to roles (e.g., “Finance Department,” “Level 2 Support”). Each role comes with a pre-defined set of privileges for specific systems, data, and resources.

The true value for MSPs lies in consistency and automation. You define a role once—such as “Level 2 Support Tech”—and assign it a specific, highly secure set of permissions (e.g., access to Client A’s systems and the ability to autofill credentials for Client B’s system, but not view the raw password). This streamlines complex, multi-client access management, making processes like onboarding and offboarding nearly automatic, auditable, and consistent.

What NordPass RBAC Changes for Admins

NordPass’ role-based access control provides MSP admins with granular control over security policy application. Admins are no longer limited to one universal company policy; they can tailor password policies to different user groups, precisely matching the security level to their roles and the data they handle.

  • Optimization for High Risk: You can enforce stricter policies—mandating higher complexity, faster password rotation, or mandatory Multi-Factor Authentication (MFA)—specifically for high-risk groups like IT Admins or the Finance team.
  • Simplification for Executives: Conversely, RBAC allows you to simplify access for high-level personnel (like the CEO) who only need access to a few mission-critical, low-rotation passwords, avoiding unnecessary friction while maintaining strong foundational security.

This balance means you no longer have to choose between strong security and satisfied users; you achieve both through the precision and granularity that NordPass provides.

Centralized Management with Tailored Security

NordPass stands ahead of competitors, who often rely on rigid, uniform policies. With the NordPass MSP Admin Panel, you get the best of both worlds:

  • Centralized Efficiency: View all clients, manage licenses, and monitor usage data from one consolidated dashboard.
  • Precise Control: The panel acts as a secure gateway, allowing you to access and apply specific, role-based security changes within each client’s individual Admin Panel without switching tools.

This dual advantage is essential for scaling. As clients reorganize or onboard new departments, NordPass ensures you can instantly update their security policies, guaranteeing seamless transitions without sacrificing administrative efficiency.

Meeting Compliance Mandates with Flexibility

For MSPs serving highly regulated clients (finance, healthcare, legal), compliance is the cost of doing business. Fortunately, RBAC perfectly aligns with auditor requirements, specifically the gold standard of security: the principle of least privilege (PoLP).

Since policies are defined by role and centrally enforced, NordPass gives you clear, undeniable audit evidence. You don’t have to scramble to prove that a temporary employee couldn’t access Protected Health Information (PHI) or that an intern couldn’t export customer data. Your defined, role-based settings handle this automatically, simplifying the compliance burden and ensuring accountability while retaining flexible management control.

“Managing access permissions doesn’t have to be a headache. With NordPass as an MSP password manager, you can quickly provision access for a new department, streamline executive logins without compromising compliance, and manage all permissions from a single, centralized dashboard.”

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Why a Cloud SIEM Just Makes Sense

2025-12-15   Cloud SIEMs solve the scalability and cost issues of traditional on-premises SIEMs by leveraging cloud-native resources. They offer flexibility, improved cost-effectiveness, and massive scalability for security data analysis. This enables robust threat detection, incident response automation (MITRE ATT&CK), and better insights across complex hybrid environments.

Continue reading

Portnox Enables NAFCS School District to Achieve Full NAC Deployment in Weeks

Austin, Texas — Dec. 9, 2025 — Portnox, a leader in cloud-native zero trust access control solutions, today announced the successful, rapid deployment of its Portnox Cloud platform at the New Albany Floyd County Consolidated School Corporation (NAFCS). The deployment streamlined device visibility and secure access control across the district’s 20 buildings and approximately 15,000 connected endpoints.

The Challenge: Enterprise Risk, Limited Resources

NAFCS, an Indiana K-12 district serving over 13,000 students and staff, manages a diverse device ecosystem, including more than 12,500 Chromebooks. Facing escalating cyber risk, the district required a comprehensive Network Access Control (NAC) solution capable of managing both its wired and wireless environments effectively.

After a thorough vendor evaluation, the district selected Portnox’s cloud-native NAC platform specifically for its operational simplicity, deployment speed, and scalability.

“In just a few days, we implemented all of the necessary policies for our network. Portnox’s ability to scale has been very impressive. With the start of the new school year, we expanded from just a few hundred registered devices to well over 10,000 in a matter of days.”

— Christopher Bowers, IT Manager at NAFCS

Big-Team Outcomes, Small-Team Implementation

Denny LeCompte, CEO at Portnox, noted that K–12 districts face risks similar to large enterprises but often lack the corresponding resources. “That’s exactly where cloud-native access control shines,” he said. “By removing the complexity of traditional NAC, we empower small IT teams to achieve big-team outcomes — faster, easier, and without the expensive hardware tax. NAFCS’s rapid rollout is the kind of success story we built Portnox Cloud for.”

Key Deployment Highlights and Benefits

  • Rapid Rollout: The district-wide deployment was completed in weeks, managed efficiently by a two-person network team.
  • Unified Device Management: Enabled seamless control of both managed endpoints (Chromebooks) and unmanaged/IoT devices across all 20 buildings.
  • Google Workspace Integration: Seamless integration supports the district’s massive Chromebook footprint, simplifying identity management.
  • Eliminated Manual Work: Delivered real-time visibility and eliminated the need for static switch port assignments. Devices now connect, and Portnox handles access control automatically.
  • Cost-Effective Security: Strengthened the district’s security posture and met compliance requirements without needing additional hardware investment.

Unexpected Operational Wins:

  • Rapid resolution of a Google Workspace sync issue, thanks to responsive Portnox support.
  • Non-IT departments (such as Facilities) gained autonomy to deploy IP-based systems without burdening the core IT team.

 

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

10 Best Practices to Prevent Ransomware Attacks and Protect Your Business

Proactive defense against ransomware is the single most vital measure organizations can take to safeguard their data, operations, and reputation. As this sophisticated malware continues to advance, exploiting targets across every sector, strengthening cybersecurity defenses and closing common entry points is non-negotiable. This comprehensive guide details the mechanism of ransomware, its vectors, and ten actionable, proven strategies for robust prevention.

Ransomware: Definition and Modern Tactics

Ransomware is malicious software that infiltrates devices or networks, encrypts critical files, and blocks access until attackers demand payment—typically in cryptocurrency. Modern variants are far more dangerous: 41% of ransomware families utilize AI-based tools in 2025 to automate phishing and adapt payloads.

Furthermore, Check Point’s Q2 2025 report shows that cybercriminals routinely employ double extortion (encrypting files plus stealing data) and nearly one-third of major incidents involve triple extortion (adding threats like DDoS attacks or public data leaks). Organizations must update defenses to keep pace with these sophisticated, fast-moving operations.

The True Cost of a Ransomware Incident

Ransomware attacks carry consequences far exceeding the ransom itself. The financial fallout is devastating. According to Sophos’s 2024 report, the average recovery cost from a single ransomware attack has surged by 50% in recent years, reaching $2.54 million.

Hidden Costs: Beyond the ransom, organizations face weeks of partial outages, lost revenue, and severe reputational damage. For example, 61% of mid-size manufacturing firms pay between $500,000 and $1,000,000, yet post-incident forensics, system rebuilding, and legal fees make up the bulk of the total cost.

Prevention—through measures like MFA, segmentation, and secure backups—is significantly more cost-effective than recovering from even one incident, potentially saving organizations millions.

How Ransomware Infiltrates Your Network (Infection Vectors)

Ransomware typically exploits organizational networks through one of the following high-risk paths:

  • Malicious Email & Phishing: A user opens a harmful file (e.g., malicious PDF or macro) disguised as a legitimate document from a trusted vendor or colleague.
  • Social Engineering: Threat actors manipulate employees into sharing login credentials or granting access by leveraging psychological tactics like urgency or impersonation.
  • Exploiting Unpatched Vulnerabilities: Attackers scan the internet for known exploits in outdated operating systems or applications, gaining remote code execution with minimal effort.
  • Weak Remote Access (RDP/VPN): Poorly configured RDP or VPN services, often lacking MFA, are brute-forced or credential-stuffed to gain an initial network foothold.
  • Drive-by Downloads: Simply visiting a compromised website can trigger a stealth installation of ransomware or exploit kits, requiring no click or download from the user.
  • Credential Theft: Attackers steal valid credentials via malware or third-party breaches, bypassing perimeter defenses to deploy ransomware broadly.

10 Tested Strategies to Prevent Ransomware Attacks

Strengthen your defenses with these proven best practices:

  • 1. Enforce Multi-Factor Authentication (MFA): The simplest and most effective prevention. MFA ensures that even stolen passwords cannot grant unauthorized access to critical systems.
  • 2. Secure Remote Access with ZTNA: Replace broad VPN access with Zero Trust Network Access (ZTNA) or secure Business VPNs to verify identity and restrict access to the bare minimum required resources. NordLayer supports this critical defense.
  • 3. Backup Data Securely (3-2-1 Rule): Maintain three copies of data, on two different types of media, with one copy offsite or immutable. This is the ultimate last line of defense against paying ransom.
  • 4. Keep Software and Systems Patched: Implement automated patch management and prioritize updates for critical vulnerabilities (CVSS 8+) to close known security gaps that attackers actively exploit.
  • 5. Implement Network Segmentation: Isolate critical systems and sensitive data into separate network zones. This prevents ransomware from spreading laterally throughout the entire network if one endpoint is breached.
  • 6. Train Employees on Security Awareness: Human error is the leading cause of infection. Conduct continuous training on identifying phishing, social engineering tactics, and reporting suspicious activity.
  • 7. Deploy Advanced Threat Protection (ATP): Use tools that go beyond basic antivirus, capable of detecting sophisticated malware, command-and-control activity, and unusual file behaviors before execution.
  • 8. Implement Strong Password Policies: Enforce long, unique passwords and combine them with MFA to limit attackers’ ability to guess or brute-force accounts. Use password managers to aid compliance.
  • 9. Use Robust Email Security Filters: Stop ransomware at its source by deploying strong filtering, attachment scanning, malicious URL detection, and DMARC/SPF/DKIM policies.
  • 10. Conduct Regular Security Audits: Perform periodic audits and penetration testing to proactively identify weak points, insecure configurations, and risky access rights before cybercriminals find them.

How NordLayer Helps You Prevent Ransomware Attacks

NordLayer provides essential tools that help reduce ransomware risk and strengthen overall security through a unified ZTNA approach:

  • ZTNA Implementation: Enables secure, encrypted remote access via a Business VPN, ensuring only approved and compliant devices can connect.
  • Network Segmentation & Control: Uses Cloud Firewall and access controls to segment networks and severely limit lateral movement.
  • Threat Blocking: Blocks access to malicious websites and detects malware in downloads using DNS Filtering and Download Protection.
  • Policy Enforcement: Enforces consistent access policies and verifies user identity across all devices and locations.

 

About Nord Security
The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Network Security Monitoring as a Service (NSMaaS): Enterprise Visibility Without the Overhead

 Until recently, achieving full network visibility was a privilege reserved for large enterprises. Advanced monitoring required significant capital investment, specialized security teams, and lengthy deployment cycles. Today, IT teams, particularly those across Europe, face heightened complexity, limited staff, and growing regulatory pressures. The threat landscape is constant, but the ability to manage it varies widely.

Making Enterprise Visibility Accessible

Managed monitoring changes the operational equation for organizations that cannot afford a dedicated 24/7 Security Operations Center (SOC). It provides many benefits similar to SOC as a Service (SOCaaS) but avoids the complexity and infrastructure burden of building a full security function internally.

With technologies like GREYCORTEX Mendel (a Network Detection and Response, or NDR, solution), providers can offer the same depth of insight previously only accessible to major corporations.

The core value is simple: organizations finally gain clarity into what is happening inside their network. They can spot misconfigurations, detect unauthorized connections, and notice the early signs of malicious activity. For many, this is the first time they can verify whether their segmentation and firewall rules are effective against real-world traffic.

How Service-Based Monitoring Works in Practice

This model is exemplified by partners like SOC360 in Poland. They combine Mendel’s deep visibility with their own expert monitoring and response processes, providing predictable costs, quick deployment, and continuous expert oversight.

Key Components of a Managed NDR Service:

  • ✅ Continuous network and log monitoring, providing a constant pulse on system health.
  • ✅ Detection of hidden threats, unauthorized access attempts, and policy violations using behavioral analysis.
  • ✅ Investigation support using historical metadata and full-context analytics for rapid root cause analysis.
  • ✅ Monthly reporting and guidance with clear, actionable recommendations for IT teams.

For many organizations, this replaces reliance on assumptions and isolated alerts with insights supported by data and clear recommendations.

Scaling Up: Visibility for Mature Security Teams

For larger organizations that maintain their own SOC, the approach shifts. Instead of outsourcing, they integrate GREYCORTEX Mendel directly into their environment. In these setups, deep network visibility becomes a powerful analytical advantage.

In-house SOC teams gain a clear view of device communication, user behavior, and performance trends over time. Crucially, they access historical data that traditional log-centric tools often cannot provide. This depth speeds up investigations, reduces noise, and helps analysts understand not only that something happened, but also how and why it occurred.

Conclusion: Visibility That Fits Any Security Maturity

Network security monitoring proves that meaningful visibility is no longer limited by the size of your security team. Smaller companies gain critical clarity without building a SOC, while mature environments enhance their detection and investigation workflows through deeper network context.

GREYCORTEX Mendel supports both needs: it enables providers to deliver reliable monitoring as a service, and it gives enterprise SOCs the analytical depth required to manage complex infrastructures. The objective remains the same: reduce uncertainty, speed up response, and create a network environment where hidden activity is harder to ignore.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

IT Operations Management (ITOM): The Silent Backbone

2025-12-11   IT Operations Management (ITOM) is the technical backbone ensuring IT infrastructure is stable, available, and efficient. It focuses on monitoring, automation, capacity planning, and configuration management (CMDB). By proactively detecting and resolving issues before users notice, ITOM complements ITSM and is rapidly evolving toward AIOps for smarter, data-driven automation.

Continue reading