Another surge in ransomware activity is currently happening, as has been the case periodically.
Cybercrime incidents always seem to be on the rise, but this time there is solid evidence to support it.
In 2023, ransomware activity saw a significant increase, following a temporary drop in 2022 due to the war in Ukraine. Studies by Palo Alto’s Unit 42 researchers showed a noticeable rise in activity throughout the year.
Chainalysis also highlights 2023 as the year of ransomware’s “comeback,” estimating that the total ransoms paid surpassed $1 billion for the first time. The company tracks cryptocurrency payments to and from digital wallets used by criminals to arrive at this figure.
Chainalysis’s approach provides additional insights compared to traditional methods of data collection, enabling the observation that ransomware criminals may take a considerable amount of time to launder their earnings from past attacks.
Ransomware groups are increasingly employing tactics to conceal their transactions, such as moving money across different blockchains and utilizing gambling services and exchanges with lenient customer verification processes.
The past year also witnessed a rise in ransomware affiliates, attracted by the simplicity of launching attacks under the Ransomware as a Service model. Additionally, ransomware creators are changing tactics by utilizing different malware strains to evade detection and potentially re-target previous victims under a new guise.
Ransom Payment Decline
Despite the increasing ransomware activity, there is evidence suggesting that victims are becoming less willing to pay the demanded ransoms.
According to Coveware’s Incident Response Team, the percentage of victims paying up decreased to a record low of 29% in Q4 2023, compared to 37% in Q4 2022.
Since the survey began in Q1 2019, the percentage of victims paying ransoms has dropped significantly from 85% to the current low levels.
These trends may be attributed to government advisories urging victims not to pay ransoms or a growing realization among defenders that paying does not guarantee a solution in the data trading era, leading them to focus on recovery efforts instead. Despite this, ransomware attackers may resort to more aggressive tactics in the future, making the threat of ransomware attacks even more challenging.
