Information theft accounted for 94% of all cyber assaults worldwide in 2024, based on new analysis, as cybercriminals more and more mix knowledge exfiltration with encryption in ransomware campaigns.
Past encryption, ransomware attackers now threaten to leak or promote an organization’s knowledge on the darkish net if victims refuse to pay. Stolen data typically consists of personally identifiable knowledge and proprietary mental property.
The findings come from BlackFog’s 2024 Ransomware Pattern Report, which analysed ransomware exercise throughout a whole lot of publicly disclosed and non-disclosed assaults on world organisations between January and December.
The report discovered the typical quantity of knowledge stolen in an undisclosed exfiltration assault is 592 GB, and the variety of disclosed and undisclosed cyber assaults elevated by 25% and 26% year-over-year, respectively.
Dr. Darren Williams, founder and chief government officer of BlackFog, stated in a press launch: “The report exhibits 2024 was a landmark yr with organizations going through rising monetary and reputational injury from ransomware assaults, with high-value sectors significantly pressured to pay ransoms to revive operations.”
Based on IBM’s Value of Information Breach report, the typical price of a ransomware assault involving knowledge exfiltration in 2024 was $5.21 million.
“As cybercriminals constantly refine their strategies to take advantage of vulnerabilities and launch large-scale assaults, defending towards ransomware is turning into more and more complicated,” Dr. Williams added. “Governments are stepping up efforts to counter this rising menace, introducing new measures reminiscent of necessary ransomware incident reporting. Nevertheless, the worldwide ransomware disaster continues to escalate at an alarming fee.”
Ransomware attackers are more and more drawn to reliable enterprise instruments
In September 2024, safety researchers found a double-extortion ransomware variant focusing on VMware ESXi servers, which each copied and encrypted the goal’s knowledge. Ransomware teams have additionally been exploiting reliable file switch expertise to safe assaults.
SEE: Microsoft Says Ransomware Teams Are Exploiting the Newly-Patched VMware ESXi Flaw
BlackFog reported that PowerShell was utilized in 56% of ransomware instances in 2024, highlighting how attackers are more and more “leveraging reliable instruments and platforms to infiltrate networks, set up a presence, and exfiltrate knowledge with out triggering alarms from many endpoint safety platforms.”
High focused industries face relentless stress
The manufacturing, companies, and expertise sectors noticed the best variety of undisclosed assaults, and are often-cited as extremely focused as a result of essential nature of their uptime, excessive ranges of digitisation, and enormous volumes of delicate knowledge.
For disclosed assaults, healthcare, authorities, and schooling have been probably the most focused, accounting for 47% of all ransomware-related information headlines in 2024. The largest surge was seen within the retail sector the place disclosed assaults spiked by 96% with high-profile victims together with Starbucks, Sainsbury’s, Morrisons, London Medicine, and Krispy Kreme.
Ransomware teams: Previous leaders persist, new gamers emerge
LockBit remained probably the most lively ransomware group, attacking 603 reported victims. This was regardless of a significant regulation enforcement takedown in February 2024, led by the U.Ok. Nationwide Crime Company’s Cyber Division, the FBI, and different worldwide companions. The operation quickly disabled LockBit’s ransomware-as-a-service platform, however the group resumed operations days in a while a brand new darkish net area.
Nonetheless, funds to LockBit decreased by 79% within the second half of the yr, based on separate analysis from Chainalysis.
BlackFog’s report recognized RansomHub because the second-most lively ransomware group of 2024. A relative newcomer, it emerged in February 2024 and shortly gained notoriety with assaults on world producer Kawasaki and oil and fuel companies firm Halliburton.
Medusa and Play ranked third in disclosed and undisclosed incidents, respectively.
Surge in new ransomware teams fueled by AI
A Cyberint report from October discovered that Q2 2024 had the best variety of lively ransomware teams on file, as smaller, newer teams entered the scene.
In January 2024, the U.Ok.’s Nationwide Cyber Safety Centre warned that the specter of ransomware was anticipated to rise as a result of new availability of AI applied sciences lowering the barrier to entry, enabling even inexperienced criminals to conduct refined assaults.
BlackFog’s analysis bolstered these findings, reporting that 48 new ransomware teams emerged in 2024, marking a 65% improve from the variety of new variants from the earlier yr. Greater than half of all ransomware assaults within the final two months of 2024 have been carried out by these newly shaped teams.