Full Report
Chainalysis says a combination of law enforcement actions and better defenses led to less money going out to ransomware actors. The post Ransomware payments dropped 35% in 2024 appeared first on CyberScoop.
Analysis Summary
# Incident Report: Global Decline in Ransomware Payments in 2024
## Executive Summary
Ransomware payments globally dropped by 35% in 2024 compared to 2023, totaling $812.55 million, despite reports indicating that the overall frequency of ransomware attacks may have increased. This reduction is primarily attributed to successful large-scale law enforcement actions against major groups like LockBit and ALPHV/BlackCat, coupled with improved organizational defenses and backup strategies. While large payments decreased, smaller, opportunistic groups continue to emerge using existing or rebranded code.
## Incident Details
- **Discovery Date:** Data compiled throughout 2024, report released **February 5, 2025**.
- **Incident Date:** Primarily throughout **2024**.
- **Affected Organization:** Not applicable (This report summarizes global trends, not a single organizational breach).
- **Sector:** Global Cybersecurity/Financial Crime.
- **Geography:** Global.
## Timeline of Events
### Initial Access
- **Date/Time:** Ongoing throughout H1 2024 (Attacks peaked before H2 2024 slowdown).
- **Vector:** Vulnerability exploitation (especially in enterprise environments) by smaller RaaS groups; leveraging rebranded or purchased code.
- **Details:** Attack frequency was high enough that Chainalysis initially expected 2024 totals to surpass 2023.
### Lateral Movement
- *Information not detailed in the scope of this trend analysis.*
### Data Exfiltration/Impact
- **Impact:** Total tracked payments fell from $1.25 billion (2023) to $812.55 million (2024).
- **Impact:** Law enforcement actions significantly disrupted major threat actors (LockBit, ALPHV/BlackCat).
### Detection & Response
- **How it was discovered:** Analysis of cryptocurrency transactions tracked by Chainalysis, alongside intelligence regarding law enforcement operations.
- **Response actions taken:** Coordinated international operations (e.g., NCA and FBI actions) dismantled key ransomware infrastructures. Organizations improved cyber hygiene, focusing on better backups and refusing to pay.
## Attack Methodology
- **Initial Access:** Exploiting vulnerabilities, leveraging RaaS infrastructure.
- **Persistence:** *Information not detailed.*
- **Privilege Escalation:** *Information not detailed.*
- **Defense Evasion:** Some groups showed aggression and speed in their methods.
- **Credential Access:** *Information not detailed.*
- **Discovery:** *Information not detailed.*
- **Lateral Movement:** *Information not detailed.*
- **Collection:** *Information not detailed.*
- **Exfiltration:** Payments tracked via blockchain analysis, with shifting reliance away from mixers toward cross-chain bridges and centralized exchanges for off-ramping.
- **Impact:** Financial loss reduction due to non-payment, operational recovery via backups.
## Impact Assessment
- **Financial:** 35% decrease in worldwide ransomware payments tracked ($1.25B down to $812.55M).
- **Data Breach:** Broad impact across numerous organizations, though specific data types are not enumerated.
- **Operational:** Organizations are shifting to internal recovery (backups) rather than relying on payment negotiations.
- **Reputational:** *Information not detailed.*
## Indicators of Compromise
- **Network indicators:** Law enforcement activity fractured established C2 infrastructure (specific indicators defanged).
- **File indicators:** *Information not detailed.*
- **Behavioral indicators:** Increased activity from smaller, opportunistic RaaS groups using pre-existing code; shift in illicit finance pathways (less mixer use, more bridge/CEX use).
## Response Actions
- **Containment measures:** Disruption of major ransomware group infrastructure (LockBit, ALPHV/BlackCat).
- **Eradication steps:** *Not detailed for individual victims, but general improvement in organizational resilience.*
- **Recovery actions:** Organizations increasingly relying on backups and robust recovery plans instead of paying ransoms.
## Lessons Learned
- **Key takeaways:** Targeted, high-profile law enforcement takedowns of major RaaS providers can significantly deter financial flows within the ransomware ecosystem. Improved organizational preparedness (backups) is an effective countermeasure.
- **What could have been done better:** The vacuum left by dismantled groups was quickly filled by smaller, opportunistic actors, indicating that ecosystem cleanup requires continuous, sustained pressure on the entire threat landscape, not just the leaders.
## Recommendations
- **Prevention measures for similar incidents:** Maintain robust, segmented backup strategies allowing organizations to refuse payment. Continue supporting international law enforcement efforts targeting RaaS infrastructure. Maintain vigilance against smaller ransomware groups leveraging familiar, potentially leaked, adversarial code.