Full Report
Ransomware payments dropped 35% in 2024 due to law enforcement crackdowns and stronger cyber defenses, forcing attackers to adapt with new tactics.
Analysis Summary
# Incident Report: 2024 Ransomware Payment Decline and Threat Actor Adaptation
## Executive Summary
Ransomware payments experienced a significant 35% drop in 2024, falling to $813.55 million, despite extortion efforts increasing in the first half of the year. This decline is primarily attributed to successful law enforcement operations targeting major groups like LockBit and ALPHV, coupled with improved organizational cyber hygiene allowing victims to refuse payment. While payments decreased, threat actors adapted by increasing data leak sites, exaggerating claims, and favoring faster attacks, signaling an ongoing, evolving threat landscape.
## Incident Details
- Discovery Date: Reporting reflective of trends throughout 2024 (Data analysis published later)
- Incident Date: Throughout 2024
- Affected Organization: Not a single incident; aggregated analysis of the global ransomware ecosystem.
- Sector: Various (Analysis covers general cybercrime trends)
- Geography: Global
## Timeline of Events
### Initial Access
- Date/Time: Ongoing throughout 2024.
- Vector: Not explicitly detailed for individual compromises, but overall activity increased in H1 2024.
- Details: Ransomware actors successfully extorted 2.38% more in the first half of 2024 compared to H1 2023.
### Lateral Movement
- N/A (Focus is on ecosystem-wide financial/operational trends, not process for a single victim).
### Data Exfiltration/Impact
- Data Leak Sites: The number of new data leak sites doubled in 2024, although some listings were duplicates or exaggerations.
- Extortion Gap: The gap between demanded ransom and paid amounts increased to 53% in H2 2024, indicating victims were less willing to pay.
### Detection & Response
- **Law Enforcement Takedowns:** Key operations targeted LockBit (February 2024) and directly resulted in ALPHV ceasing operations following an affiliate dispute.
- **Victim Resilience:** Improved cyber hygiene, use of decryption tools, and backup restoration enabled organizations to refuse payment.
- **Response:** Law enforcement actions curtailed major ransomware storefronts and led to changes in how threat actors laundered funds (less use of mixers).
## Attack Methodology
- Initial Access: Not specified, implied through generic ransomware entry vectors.
- Persistence: N/A
- Privilege Escalation: N/A
- Defense Evasion: New ransomware strains emerged using leaked or purchased code to evade detection.
- Credential Access: N/A
- Discovery: N/A
- Lateral Movement: N/A
- Collection: Attackers are executing faster attacks, with negotiations beginning within hours of data exfiltration.
- Exfiltration: Threat actors sometimes exaggerated the extent of data compromised or reposted old attack results.
- Impact: Data encryption and/or exfiltration (Double Extortion model remains active, evidenced by increased leak sites).
## Impact Assessment
- Financial: Ransomware payments globally declined by 35% to ~$813.55 million in 2024. A record $75 million payment was made to Dark Angels in early 2024.
- Data Breach: The number of new data leak sites doubled, indicating continued data theft, even if payments decreased. Organizations showed improved ability to restore data without paying.
- Operational: Improved organizational resiliency allowed victims to recover operations without succumbing to extortion demands.
- Reputational: Threat actors attempted to maintain relevance post-takedown by exaggerating their successes or reusing old breach claims ("Operation Cronos").
## Indicators of Compromise
*Note: Since this report summarizes industry trends rather than one specific breach, IoCs listed are derived from major groups mentioned.*
- **Network indicators:** Diminished use of mixing services (e.g., Chipmixer, Tornado Cash) for laundering funds; increased use of cross-chain bridges. Criminal funds increasingly held in personal wallets.
- **File indicators:** Emergence of new ransomware strains based on leaked/purchased code.
- **Behavioral indicators:** Rapid commencement of ransom negotiations, sometimes within hours post-exfiltration.
## Response Actions
- **Containment:** Successful international law enforcement operations targeting LockBit and contributing to the collapse of ALPHV. Sanctions and crackdowns on crypto mixing services.
- **Eradication:** Threat actors are attempting to adapt their laundering tactics (moving to personal wallets, using different methods).
- **Recovery:** Organizations globally improved their capability to recover data via backups or decryption tools, reducing the incentive to pay.
## Lessons Learned
- Law enforcement actions, when coordinated and decisive, can significantly disrupt the financial streams of major ransomware operations.
- Improved organizational cyber hygiene and off-line recovery capabilities are highly effective deterrents against large ransomware payouts.
- Threat actors rapidly adapt to enforcement actions by changing laundering mechanisms (e.g., shifting from mixers to personal wallets/bridges) and using new code variants.
- Ransomware groups post-takedown (e.g., LockBit) often attempt swift resurfacing, though with diminished financial returns initially.
## Recommendations
- Continue to prioritize robust, tested backup and disaster recovery procedures to ensure business continuity without ransom payment.
- Organizations should review the effectiveness of their cyber insurance and resilience planning, as the gap between demanded and paid ransom is widening.
- Monitor for new ransomware variants emerging from actor groups attempting to fill voids left by targeted entities like LockBit and ALPHV.
- Governments should consider further regulation, such as the proposed ban on ransomware payments in critical industries, to reduce the profitability of these attacks.