GuidePoint Security, a cybersecurity solutions leader enabling organizations to make smarter decisions and minimize risk, announced today the release of GuidePoint Research and Intelligence Team’s (GRIT) Q1 2024 Ransomware Report.
In addition to revealing a nearly 20% year-over-year increase in the number of ransomware victims, the GRIT Q1 2024 Ransomware Report observes major shifts in the behavioral patterns of ransomware groups following law enforcement activity – including the continued targeting of previously “off-limits” organizations and industries, such as emergency hospitals.
The GRIT Q1 2024 Ransomware Report takes an in-depth look at the shifting RaaS ecosystem, including the residual impact on LockBit from the Operation Cronos Task Force, an international law enforcement effort helmed by the UK National Crime Agency (NCA). Other notable Q1 ransomware events include an apparent exit scam from Alphv following its highly-publicized Change Healthcare ransomware attack, re-extortion attempts from Phobos affiliates and self-proclaimed renewed collaboration from members of the “Five Families” cybercrime collective.
Key Highlights of the Report:
- Q1 2024 resulted in a nearly 20% increase in reported victims over Q1 2023, despite the disruption of LockBit and the disbandment of Alphv, two of the largest and most prolific ransomware groups.
- The number of active ransomware groups more than doubled year-over-year, increasing 55% from 29 distinct groups in Q1 2023 to 45 distinct groups in Q1 2024.
- The top three most active ransomware groups were LockBit, Blackbasta and Play. Even with significant law enforcement disruption in February 2024, LockBit maintained the top spot among RaaS service operations at 219 victims, albeit with a lower operational tempo compared to previous quarters. LockBit claimed an average of almost 3 victims per day before the disruption occurred on February 20th, and had an average of about 2 victims per day from February 24th through the end of March.
- The industries most impacted by ransomware in Q1 2024 were manufacturing, retail & wholesale and healthcare, respectively. The retail & wholesale industry experienced a surge in observed activity during the quarter, accounting for 7% of all observed posts and overtaking healthcare to become the second-most impacted industry.
- For the first time since Q2 2023, over half of all observed ransomware victims were based in the United States, making it the most targeted country with a total of 537 victims. Though the United Kingdom saw the largest decrease in observed victims by country (-26%), it still held the second highest number of observed ransomware attacks (60).
The GRIT Q1 2024 Ransomware Report is based on data obtained from publicly available resources, including threat groups themselves, as well as threat analyst insights into the ransomware threat landscape.
For more information:
Like this:
Like Loading...
Related
This entry was posted on April 18, 2024 at 9:00 am and is filed under Commentary. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
GuidePoint Security Finds Increased Ransomware Activity, New Group Behavior Patterns in Q1 2024 Ransomware Report
GuidePoint Security, a cybersecurity solutions leader enabling organizations to make smarter decisions and minimize risk, announced today the release of GuidePoint Research and Intelligence Team’s (GRIT) Q1 2024 Ransomware Report.
In addition to revealing a nearly 20% year-over-year increase in the number of ransomware victims, the GRIT Q1 2024 Ransomware Report observes major shifts in the behavioral patterns of ransomware groups following law enforcement activity – including the continued targeting of previously “off-limits” organizations and industries, such as emergency hospitals.
The GRIT Q1 2024 Ransomware Report takes an in-depth look at the shifting RaaS ecosystem, including the residual impact on LockBit from the Operation Cronos Task Force, an international law enforcement effort helmed by the UK National Crime Agency (NCA). Other notable Q1 ransomware events include an apparent exit scam from Alphv following its highly-publicized Change Healthcare ransomware attack, re-extortion attempts from Phobos affiliates and self-proclaimed renewed collaboration from members of the “Five Families” cybercrime collective.
Key Highlights of the Report:
The GRIT Q1 2024 Ransomware Report is based on data obtained from publicly available resources, including threat groups themselves, as well as threat analyst insights into the ransomware threat landscape.
For more information:
Share this:
Like this:
Related
This entry was posted on April 18, 2024 at 9:00 am and is filed under Commentary. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.