What This Report Covers
This edition covers the second quarter of 2024. Its news section covers Europol’s Operation Endgame, which shut down over 100 malware servers, and the international operation that named the LockBit leader.
Key Findings of the Ransomware Trends Report Q2 2024
The report analyses over 1,206 ransomware incidents in the second quarter of 2024 and tracks 51 active groups, comparing them with the first quarter.
- The United States was the most targeted country with 56.9% of attacks, followed by the United Kingdom (6.1%), Canada (5.5%), Germany (3.2%) and Italy (2.4%).
- Manufacturing was the most targeted sector at 22.9% of incidents, ahead of business services (13.7%) and retail (10.1%).
- LockBit was the most active group with 18.6% of attacks, followed by Play (10%), Medusa (6.1%), Black Basta (5.1%) and Hunters (4.6%).
- The picture is fragmented: smaller groups together were behind 38.9% of attacks.
- Some groups grew from Q1 to Q2, among them Play, Medusa and Ransomhub.
- The report notes that Europol's Operation Endgame shut down more than 100 malware servers.
The full PDF adds profiles of Play, Medusa, Black Basta, Hunters and Inc Ransom. It also covers the quarter's important ransomware news, the most used CVEs and the groups' tactics, techniques and procedures.
The United States accounted for 56.9% of attacks, up from the previous edition, and manufacturing became the most affected sector at 22.9% of incidents. The report shows that groups differ in method; for example, Play focuses on exploiting vulnerabilities in Microsoft Exchange.
It also notes that groups such as INC Ransom increasingly use double or triple extortion. A short definition of the threat is in the ransomware glossary entry.
It shows that, within one year, the sector most affected moved from business services in the first quarter to manufacturing in the second, a change that readers in either field should check against their own risk.
Security professionals often struggle to keep up with evolving ransomware trends due to the constant barrage of information. We aim to help you filter this overload, present the 2024 Ransomware Trends in an understandable format, and convert this information into meaningful insights.
Exploring Ransomware Trends in Q2 of 2024: Our Comprehensive Analysis
Q2 2024 Ransomware Trends: Key Insights
- Operations like Europol’s “Operation Endgame”, which shut down over 100 malware servers and disrupted numerous botnets, reduced the infrastructure available for ransomware distribution.
- The United States, which accounts for more than half of the ransomware attacks, stands by 56.9%.
- The manufacturing sector is the most affected, comprising 22.9% of the total incidents, reflecting its prominence as a high-value target for cybercriminals.
- Different ransomware groups employ varied tactics. For instance, the Play ransomware group focuses on exploiting vulnerabilities in Microsoft Exchange.