The ransomware threats in 2024 saw a significant evolution, with new groups emerging, attacks intensifying, and industries struggling to keep pace. This blog delves into the critical statistics, trends, and lessons learned from Cyberint’s “Ransomware Annual Report 2024“, offering insights to help businesses strengthen their defences in 2025.
A record year for ransomware activity
Ransomware attacks reached new heights in 2024, with 5,414 published incidents globally, marking an 11% increase compared to 2023. The surge was most evident in Q4 2024, which recorded 1,827 attacks – 33% of the year’s total. This quarter alone represented a staggering 29% increase from Q4 2023, reflecting a dramatic escalation in activity.
The USA remained the primary target, with 2,713 attacks accounting for over 50% of global incidents, followed by Canada (283 attacks) and the UK (268 attacks). The business services sector was hardest hit, with 1,302 attacks, highlighting its vulnerability to sophisticated ransomware operations.
The rise of new players
2024 saw the emergence of 46 new ransomware groups, bringing the total number of active groups to 95 – a 40% increase from the previous year. Among these, RansomHub dominated, claiming 531 attacks and outpacing even long-standing threats like LockBit and Play.
Notable newcomers included:
- Fog: Specializing in the education sector.
- KillSec: Targeting industries in India and beyond.
- Lynx: Focusing on double extortion tactics.
The fragmentation of established groups, such as LockBit, following law enforcement disruptions allowed smaller, agile players to gain prominence.
Targeted industries: Who’s at risk?
Certain industries bore the brunt of ransomware attacks in 2024:
- Business Services: 24.1% of all incidents (1,302 attacks).
- Retail: 15.2% of incidents (820 attacks).
- Manufacturing: 10.5% of incidents (573 attacks).
- Construction: A standout, with a 50% increase in attacks compared to 2023.
The growing focus on construction reflects ransomware operators’ adaptability, targeting sectors with lower cybersecurity maturity.
Emerging trends and evolving tactics
Ransomware groups continued to innovate in 2024, employing new tactics to bypass defences and maximise impact.
Linux and VMware ESXi systems under fire
- Operators exploited vulnerabilities in Linux-based systems and VMware ESXi servers, which host critical business infrastructure.
- Groups like Play and BlackByte developed tools specifically to target these environments.
The rise of Ransomware-as-a-Service (RaaS)
- RaaS models lowered the barrier to entry for cybercriminals, enabling rapid growth in new groups. Affiliates retain a majority of ransom payments, incentivizing widespread attacks.
Cloud-Based Data Exfiltration
- Operators increasingly used tools like Microsoft Azure Storage Explorer to steal data, reflecting a shift towards cloud-targeted ransomware campaigns.
Law enforcement strikes back
2024 wasn’t all wins for ransomware groups. Law enforcement made significant inroads, disrupting major operations:
- LockBit: Arrests and infrastructure seizures weakened the group, though they are poised for a comeback with LockBit 4.0.
- Dispossessor/Radar: The FBI dismantled their network in a major international operation.
- Cryptocurrency Exchanges: German authorities shut down 47 platforms used for laundering ransomware proceeds.
These actions disrupted operations but also fostered fragmentation, allowing smaller, more elusive groups to thrive.
Lessons for 2025 and beyond
The 2024 statistics highlight a clear reality: ransomware is evolving faster than many organisations’ defences.
Key takeaways include:
Strengthen defences against Linux and ESXi attacks
Businesses must prioritise security for virtualisation environments, ensuring patches are applied promptly and configurations are secure.Adopt a proactive approach
- Invest in endpoint detection and response (EDR) tools.
- Implement immutable backups to ensure data recovery.
- Conduct regular security awareness training to mitigate human error.
Monitor Emerging Threats
Keep an eye on new ransomware groups and evolving tactics. Partnering with cybersecurity providers who specialise in threat intelligence can make all the difference.
Looking ahead: Predictions for 2025
As ransomware groups adapt, 2025 is expected to bring:
- Increased sophistication, with AI-powered attacks gaining traction.
- More advanced double and triple extortion models*.
- Continued focus on cloud environments and Linux-based systems.
- A surge in RaaS-driven operations, fuelling the rise of new groups.
The road ahead will require collaboration between businesses, governments and cybersecurity providers to combat this ever-evolving threat.
Ransomware in 2024 served as a stark reminder that no organisation is immune. By understanding the trends and strengthening defences, businesses can better prepare for the challenges ahead.
* Definitions of Double and Triple Extortion Models
Double Extortion Model
In a double extortion ransomware attack, threat actors go beyond encrypting an organisation’s data. They also exfiltrate sensitive information and threaten to release it publicly if the ransom isn’t paid. This tactic increases pressure on victims, as the exposure of proprietary data, customer information, or intellectual property can result in reputational damage, legal consequences, and financial losses – even if backups allow for data recovery without paying the ransom.
Triple Extortion Model
Triple extortion takes the double extortion model further by incorporating an additional layer of pressure. Beyond encrypting and exfiltrating data, attackers target a third party, such as customers, partners, or vendors of the victim organisation, by threatening them with data exposure. In some cases, attackers may also launch denial-of-service (DDoS) attacks against the victim to disrupt operations further, amplifying the ransom demand’s urgency and impact.
Both models are designed to maximise leverage over victims, increasing the likelihood of payment.
