Summary: Despite disruptions to high-profile ransomware gangs LockBit and BlackCat, Q1 2024 saw a 21% increase in ransomware attacks compared to Q1 2023, according to Corvus Insurance.
Threat Actor: LockBit | LockBit
Victim: Various organizations | ransomware victims
Key Point :
- Ransomware attacks in Q1 2024 increased by 21% compared to Q1 2023.
- Despite disruptions to LockBit and BlackCat, ransomware activity continues to grow.
- 1,075 leak site ransomware victims were posted during Q1 2024.
- Law enforcement’s impact on ransomware activity is expected to be significant in the long term, but it is not enough to curb criminal activity currently.
Despite significant disruptions for high-profile ransomware gangs LockBit and BlackCat, Q1 2024 became the most active first quarter ever recorded — a 21% increase over Q1 2023, according to Corvus Insurance.
In January, Corvus reported that global ransomware attacks in 2023 set a record high, surpassing 2022 by close to 70%. The Q1 Ransomware Report shows that 2024 is picking up right where 2023 left off.
According to the data, 1,075 leak site ransomware victims were posted on leak sites during the first quarter of 2024, despite the disruption of two major ransomware groups, LockBit and ALPHV/BlackCat, which accounted for 22% and 8% of the activity, respectively.
“The ransomware activity we’ve seen in Q1 of 2024 continues the substantial growth pattern that we saw develop over the course of 2023. While we fully expect that law enforcement’s long-term impact will be significant, it’s not enough to curb this criminal activity today,” said Jason Rebholz, CISO, Corvus Insurance. “Businesses across all industries must embrace vigilant cybersecurity practices, including proactive and persistent patch management of any vulnerable assets in their environment.”
Global law enforcement operation hits LockBit
In the first quarter of 2024, an international law enforcement operation targeted LockBit’s infrastructure, resulting in its operations declining from their status in 2023 and 2022. Lockbit’s operators have begun to rebuild but are currently operating at a decreased rate.
ALPHV/BlackCat’s high-profile attack on a large healthcare technology company in early March severely impacted thousands of medical practices and pharmacies across the US Following the attack, ALPHV/BlackCat conducted an exit scheme, pretending to shut down, and then taking all the funds.
In a typical scenario, the group would take a standard 20-25% and share the remainder with the affiliates, which purchase predeveloped ransomware tools from groups like ALPHV/BlackCat to execute attacks and receive a share of the payout. In this instance, the affiliates received nothing.
Despite these developments, ransomware attacks continued to grow in the first quarter of 2024, likely due to other ransomware affiliate groups shifting operations to new and alternative organizations. In fact, 18 new leak sites emerged over Q1, the largest number of leak sites to emerge in a single quarter on record. These additions brought the total number of active leak sites for the first quarter to 60.
Source: https://www.helpnetsecurity.com/2024/05/07/ransomware-activity-q1-2024/
“An interesting youtube video that may be related to the article above”