Ransomware-Attacks are on the Rise 2024

Lockbit has emerged as the most active ransomware group during this summer, followed by two factions originating from the Conti group.

Ransomware attacks have seen a resurgence after a recent decline, with older ransomware-as-a-service (RaaS) groups leading the charge, according to data from NCC Group. Researchers collected data by closely monitoring the leak sites used by ransomware groups and extracting victim information as it becomes available. In July, Lockbit stood out as the most prolific ransomware gang, with 62 attacks, which is ten more than the previous month and more than double the combined total of the second and third most active groups. The researchers noted, "Lockbit 3.0 maintains its position as the most formidable ransomware group," and emphasized the need for all organizations to be aware of it.

The second and third most active groups are Hiveleaks with 27 attacks and BlackBasta with 24 attacks. Both groups have seen significant growth since June, with Hiveleaks experiencing a 440 percent increase and BlackBasta a 50 percent rise in their activity.

One possible reason for the increase in ransomware attacks is the U.S. government's intensified efforts against Russian cybercrime in May. The government offered up to $15 million for valuable information about Conti, which was then the most prominent ransomware group globally. The researchers speculate that threat actors may have undergone structural changes and adapted to new operational modes, leading to an increase in their successful compromises.

Hiveleaks and BlackBasta are the outcomes of this restructuring, with both groups having ties to Conti. Hiveleaks operates as an affiliate, while BlackBasta functions as a new strain. This suggests that Conti's presence has reemerged in the threat landscape under different identities.

As Conti has effectively split into two factions, the researchers anticipate that these figures could continue to rise as we enter August.