Secureworks: Ransomware takedowns didn’t put off cyber criminals

The successful dismantling of the LockBit ransomware crew and the subsequent exposure of its key players have been widely discussed in the cyber security community over the past year. However, despite these efforts, cyber criminals seem undeterred, as indicated by Secureworks’ annual 2024 State of the Threat Report, which reveals a 30% increase in active ransomware groups using leak sites.

During the period from June 2023 to July 2024, 31 new ransomware actors entered the ecosystem, with LockBit accounting for 17% of ransomware listings. This percentage decreased by 8% due to the disruption caused by the UK’s National Crime Agency’s Operation Cronos assault.

Other prominent ransomware groups, such as BlackCat/ALPHV and Clop/Cl0p, have also experienced setbacks in the past year. On the other hand, Play and RansomHub have seen an increase in their activities, with the emergence of new groups like Qilin making their mark in high-profile attacks.

Don Smith, vice president of threat intelligence at Secureworks Counter Threat Unit (CTU), emphasized the evolving nature of the ransomware business model, with increased affiliate migration leading to a larger number of groups and added complexity for network defenders.