Summary: The second quarter of 2024 saw a surge in ransomware attacks led by new groups, with significant increases in demands and payouts. The evolution of tactics, including double-extortion schemes, has made it crucial for organizations to adopt multi-layered security strategies to mitigate risks.
Threat Actor: RansomHub, PLAY, Medusa, INC Ransom, BlackSuit | RansomHub, PLAY, Medusa, INC Ransom, BlackSuit
Victim: Various industries | various industries
Key Point :
- New ransomware groups have led to a 16% increase in attacks compared to Q1 2024.
- The average ransomware demand reached $1,571,667, a 102% increase from the previous quarter.
- 93% of ransomware incidents in 2024 involved data theft, up from 88% in 2023.
- Construction became the most targeted industry, with significant increases in attacks on IT Services and Software Development sectors.
- Organizations with effective backup strategies incurred median claim costs 72% lower than those without.
During the second quarter, new ransomware groups, including PLAY, Medusa, RansomHub, INC Ransom, BlackSuit, and some additional lesser-known factions, led a series of attacks that eclipsed the first quarter of this year by 16% and the second quarter of 2023 by 8%, according to Corvus Insurance. These new threat actors emerged following the international law enforcement’s takedown of LockBit and BlackCat.
Ransomware: Most frequently targeted industries (Source: Corvus Insurance)
Ransomware demands and payouts
Based on Corvus data, the Q2 report found that the average ransomware demand reached $1,571,667. That represents a quarterly increase of 102% and the highest figure Corvus has reported since the second quarter of 2022. The average ransom payment also reached a new high of $626,415.
According to the research, a company’s backup strategies can impact payouts. Businesses without robust backups are more than twice as likely to surrender to ransom demands during an attack. Conversely, organizations with effective backup strategies have incurred median claim costs 72% lower than their less-prepared counterparts.
Ransomware operators continue evolving tactics
Recognizing that many organizations possess valuable and sensitive information, ransomware operators have evolved their tactics by engaging in double-extortion schemes where operators encrypt data, exfiltrate it, and then threaten to release it on the dark web.
So far in 2024, data theft was involved in 93% of ransomware incidents observed by Corvus, up from 88% in 2023. Using double-extortion schemes, even organizations with secure backups may be forced to pay ransoms, often to prevent the exposure of stolen data.
“Data theft has become the technique employed by attackers to secure maximum payouts from their victims, whether or not they have secure backups,” said Jason Rebholz, CISO at Corvus Insurance. “A robust security plan is never one layer deep. While a sound backup strategy is important, it cannot mitigate these threats alone. Businesses must utilize a multi-layered security strategy based on a resilient environment with fast detection and prevention capabilities.”
Key industry trends
While the study found that industries most affected by ransomware attacks remained largely similar from the first quarter, Construction moved from second to first in the second quarter. In addition, Government and Oil and Gas joined the list, and ransomware attacks targeting the Software Development and IT Services and IT Consulting sectors were up 257% and 54%, respectively.
RansomHub was responsible for 16% of the reported victims within the IT Services industry, followed by PLAY and BlackSuit, which accounted for an additional 18%.
Source: https://www.helpnetsecurity.com/2024/09/02/ransomware-crisis-attacks-payouts