What This Report Covers
This edition covers the third quarter of 2024 and describes a fragmented landscape: smaller actors made up 44.1% of attacks, while RansomHub led among major groups with 16%.
Key Findings of the Ransomware Trends Report Q3 2024
The report analyses over 1,218 ransomware incidents in the third quarter of 2024 and tracks 58 active groups, comparing them with the second quarter.
- The landscape was fragmented: smaller actors made up 44.1% of attacks, while RansomHub was the largest single group at 16%.
- RansomHub rose from 63 attacks in Q2 to 195 in Q3, while LockBit fell from 210 to 85.
- The United States accounted for 54.2% of attacks; its count rose from 621 in Q2 to 660 in Q3.
- Manufacturing was the most targeted sector at 20.5% of events, ahead of business services (14.9%) and retail (11.6%).
- By region, North America took 60.3% of attacks and EMEA 25.9%.
- After the Qakbot botnet takedown, the report says Black Basta developed custom malware and new tools for rapid ransomware deployment.
The full PDF adds profiles of Ransomhub, Meow, Medusa, Play and Akira. It also covers the quarter's ransomware news, a breakdown by company revenue, the most used CVEs, tactics and techniques, and recommendations.
By region, North America took 60.3% of attacks, EMEA 25.9%, APAC 8.8% and Latin America 5%. The U.S. alone accounted for 54.2%. Manufacturing led sectors at 20.5%, followed by business services at 14.9% and retail at 11.6%.
It also covers BlackBasta, which after the Qakbot takedown built custom malware and used new tools called SilentNight and Cogscan. Small businesses are noted as frequent targets. See the ransomware glossary entry for the basics.
The fragmented picture matters for planning: with many smaller actors active, defenses need to cover many kinds of attack rather than a few known names. The report supports region-specific as well as sector-specific preparation.
Security professionals often struggle to keep up with evolving ransomware trends due to the constant barrage of information. We aim to help you filter this overload, present the 2024 Ransomware Trends in an understandable format, and convert this information into meaningful insights.
Exploring Ransomware Trends in Q3 of 2024: Our Comprehensive Analysis
Q3 2024 Ransomware Trends: Key Insights
- Ransomware attacks in Q3 2024 were marked by a fragmented threat landscape, with smaller actors comprising 44.1% of attacks, while major players like RansomHub (16%) led, highlighting the increasing need for diverse and region-specific cybersecurity strategies.
- In Q3 2024, ransomware attacks were predominantly focused on North America (60.3%), followed by EMEA (25.9%) and APAC (8.8%), with Latin America (5%) facing the least but potentially increasing threat, indicating a strong focus on developed economies.
- In Q3 2024, ransomware attacks primarily targeted manufacturing (20.5%), followed by business services (14.9%) and retail (11.6%)
- Following the takedown of the Qakbot botnet, BlackBasta has adapted its strategy by developing custom malware and using new tools like “SilentNight” and “Cogscan” for rapid ransomware deployment. This shift highlights the group’s increasing complexity and speed in carrying out attacks, moving away from traditional phishing methods.
- Cybercriminals frequently target small businesses, likely due to their lower investments in cybersecurity.
- In Q3 2024, ransomware attacks were highly concentrated in the U.S. (54.2%), but smaller and developing countries, represented by the 22% “Other” category, also faced significant threats, underscoring the global and diverse nature of cyber vulnerabilities.