The Rise and Fall of Ransomware Ops

In a fascinating shift, ransomware attacks reached new heights in 2023 before law enforcement efforts led to a notable downturn in 2024. A comprehensive analysis by the Financial Crimes Enforcement Network (FinCEN) highlights this trend, spotlighting the impact of dismantling major ransomware groups like ALPHV/BlackCat and LockBit.

FinCEN’s data covers a period from January 2022 to December 2024, noting over 4,194 ransomware incidents. The sheer amount paid to these threats exceeded $2.1 billion—substantially significant when you consider it’s nearly the cumulative total of information reported on acts over eight years previously.

Remarkably, from 2013 to 2024, approximately $4.5 billion was extorted through ransomware. Yet, the tide is turning, thanks in part to more determined law enforcement action.

Impact of Law Enforcement Activities

The zenith of ransomware activity was in 2023, according to FinCEN, with 1,512 attack incidents and an alarming $1.1 billion in ransom demands—marking a 77% increase from the previous year. However, there was a downturn in 2024, with reported incidents dropping and total payments decreasing to $734 million.

This decline reflects successful crackdowns on groups like BlackCat and LockBit, which led to either their restructuring or a hiatus in their operations. Ransom demands typically remained under $250,000, with sectors like manufacturing, finance, and healthcare frequently targeted. Within these industries, financial institutions suffered the most significant financial losses.

Manufacturing, financial services, and healthcare were the hardest-hit sectors. With financial services alone shelling out roughly $365.6 million, they bore the highest cost of ransomware demands, followed by healthcare at $305.4 million, and manufacturing at $284.6 million.

Ransomware Trends and Payments

FinCEN also untangled the web of 267 unique ransomware families, noting that a small number were responsible for most attacks. Akira ransomware led the charge, noted in 376 reports, while ALPHV/BlackCat and LockBit amassed the largest payouts, $395 million and $252.4 million, respectively.

Other prominent ransomware groups included Black Basta, Royal, BianLian, Hive, Medusa, and Phobos. These top ten collectively raked in around $1.5 billion in ransom payments between 2022 and 2024. Bitcoin was the predominant currency of choice in 97% of these payments, with occasional use of Monero, Ether, Litecoin, and Tether.

FinCEN emphasizes the importance of reporting incidents to the FBI and sharing payment information, vital for mounting more effective defenses against cybercrime. This collective effort can significantly help curb ransomware’s threat.

Let’s work towards a safer digital world. Stay informed and alert by subscribing to Qsentinel for more updates on cybersecurity trends and tips.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.