Ransomware Attacks Appear to Keep Surging

Hopes for a lull in ransomware attacks have dissipated amid a wave of record-setting attacks launched despite apparent turnover in the criminal underground.

See Also: Live Webinar | Thrive in Chaos: How to Get Your Minimum Viable Company Back Online

Cybersecurity firm NCC Group counted 590 new victims in January, a 3% bump from the previous, also record-setting month. Threat-intelligence firm Cyble counted 518 newly disclosed victims in January, rising to 599 for the first 27 days of February, of which two-thirds targeted U.S.-based organizations. Other ransomware monitors also tracked increases in the overall quantity of victims over the past two months.

Victim counts vary from firm to firm due to disagreement over whether newly listed older victims should be counted as new.

Whatever the exact number, ransomware-tracking experts agree that in recent months, RansomHub, Play and Akira are among those that appear to have dominated these past couple busy months.

Counting ransomware victim listings is one technique researchers use to try and track the ransomware ecosystem’s ebb and flow despite the known limitations of leak sites. Among them: groups regularly lie. Groups sometimes also clean house, dumping lots of older, non-paying victims’ names or data at once. Leak sites ultimately are tools wielded by digital criminals for pressuring victims into paying, as well as to scare future victims. Some organizations pay rapidly in a bid to keep details of the attack under wraps. Getting paid quickly also suits criminals, and keeping it quiet makes the extent of their operation – as well as the tactics and techniques they used – more difficult for law enforcement to track and disrupt.

About a quarter of victims hit with crypto-locking malware or data theft appear to pay a ransom, most often for an untrustworthy pledge from attackers to delete stolen data.

The Akira ransomware group, in a Jan. 31 “Taking stock of 2024” post, named more than 30 victims for the first time, saying they were a subset of organizations it breached in 2024 but hadn’t yet listed. The group continued to try and pressure the victims into paying a ransom, in part for a promise to remove their name from its now-public list.

Clop – aka Cl0p – listed 112 victims in January and 49 more in February, by Cyble’s count. These all appear to have been amassed from the group’s apparently semi-thwarted mass attack in December 2024 against users of managed file-transfer software built by Cleo Communications. Clop hasn’t deviated from its strategy of skipping the cryptolocking stage to go straight to stealing data and holding it to ransom, frequently by targeting file-transfer software.

Not long after its mass attack on Cleo users – allegedly including Cleo itself – the ransomware group claimed to have amassed at least 66 victims, including Arizona-based supply chain management software provider Blue Yonder, Atlanta-based EspriGas, Phoenix-based Western Alliance Bank, Dutch software developer C3 Group, Australian transport fuel supplier Ampol and Canada’s Polaris Transport.

Provided Clop’s data leak site can be believed, the criminals are drip-feeding details about the true scale of their success. Clop claims to have successfully stolen data from Hertz Global, AOL, DXC Technology as well as both HP and Hewlett Packard Enterprise. Whether any of that is true, or if any sensitive information got stolen, remains unclear.

Newcomers Remain Constant

Ransomware is relentless, but ransomware groups come and go. Some groups, such as Black Basta, appear to burn out – or be on their way to doing so. Others decline due to law enforcement disruption, as appears to be happening with LockBit. Sometimes, groups get greedy and run an exit scam, as Alphv, aka BlackCat, did 12 months ago to keep the entirety of a reported $22 million ransom paid by UnitedHealth Group over the Change Healthcare breach rather than sharing it with the affiliate who conducted the attack.

For every group that exits, plenty of new ones emerge – even if the “new” group is merely a rebrand. Many of the people involved in the ransomware ecosystem stay the same. Also, affiliates, who serve as the hacking business partners for one or more operations at a time, are responsible for many of the attacks, regardless of the banner under which they might get carried out.

In 2024, 48 new ransomware groups emerged, reported cybersecurity firm BlackFog. Newcomers include RunSomeWares, which has listed four victims on its data-leak sites, as well as Linkc, which has only listed one, Cyble said. Whether the groups remain going concerns remains to be seen.

Anubis, a Russian-speaking group that appeared to become active by December 2024, appears to be the handiwork of former ransomware group affiliates, based on the sophistication of its offerings, and which has representatives on both the RAMP and XSS cybercrime forums, said threat intelligence firm Kela.

The ransomware operation offers three different types of services, Kela said. This includes a “classic” 80/20 ransomware-as-a-service operation, promising affiliates 80% of every ransom one of their victims pays after infecting them with the group’s ransomware, which runs across Windows, Linux, network-attached storage and ESXi environments. The group also runs a Tor-based data-leak blog where it has listed so far only a handful of victims.

The operation also advertises two other, unusual offerings. These include a 60/40 data-ransom-as-a-service offering, giving participants 60% of any revenue paid by a victim they extort using already stolen data, with Anubis promising to highlight the data set in a blog post and pressure the victim in a variety of ways, including alerting local data privacy regulators, Kela said.

“The data must meet the following requirements: it must be exclusive (meaning it hasn’t been published anywhere on the Clearnet or Darknet before), the breach must be recent (no older than six months) and its content must be deemed ‘interesting for publication,'” it said.

Anubis has a 50/50 offering for initial access brokers, whereby it promises to give them 50% of any ransom paid by a victim for which the IAB shares access credentials. Terms and conditions apply: The victim must be in the U.S., Canada, Europe or Australia; not have fallen victim to another ransomware group in the past 12 months; and not hail from the government, education or non-profit sector, Kela said. The healthcare sector appears to remain fair game.

Ransomware groups have long partnered with initial access brokers, sometimes paying them a commission to have right of first refusal on all new “accesses” they obtain. As Anubis’ pitch highlights, the usefulness of such brokers in the cybercrime economy is strong. “Access broker activity surged in 2024, with advertised accesses increasing by nearly 50% over 2023,” especially as many criminal groups continue to seek “faster and stealthier methods” for infiltrating targets, said cybersecurity firm CrowdStrike in a recent report.