Ransomware Leak Sites Suggest Attacks Reached Record High

Ransomware hackers had a great December, if their leak sites are to believed, collectively listing the greatest number of victims ever seen in a one-month period.

See Also: Ransomware Risk Report: Insights from 900+ IT and Security Leaders

Attackers claimed 621 victims in December, a number itself part of a rising tide of digital extortion, with 584 declared victims in November and 542 in October. The numbers come from security operations platform ReliaQuest. The three month total of 1,747 total victims – including 937 U.S. organizations – represented a 43% increase from the previous quarter.

“A key factor behind this surge is likely the growth of the ransomware ecosystem itself. In 2022, there were around 60 active ransomware groups, but by 2024, this had ballooned to almost 100,” ReliaQuest said. “With so many more groups in the game, it’s no wonder we’re seeing record-breaking levels of activity.”

Other experts beg to differ. “The likely explanation is a year-end dump: victims who didn’t pay but hadn’t yet been published were added to blogs before the January holidays,” said ransomware researcher Yelisey Bohuslavskiy, a partner at threat intelligence firm RedSense. “This aligns with known publishing patterns from these groups.”

ReliaQuest also counted 13 groups new groups appearing at the end of 2024:

• October: Interlock, Nitrogen, PlayBoy, Sarcoma;
• November: Argonauts Group, Chort, Hellcat, Kairos, SafePay, Termite;
• December: BlueBox, Funksec, LeakedData.

Some of these groups have already claimed a notable number of victims. FunkSec claimed 82 victims and SafePay claimed 45 victims. Notably, those groups have surpassed, or nearly surpassed, the 54 victims listed the same quarter by the once high-flying Black Basta operation, as well as the five listed in December by LockBit, following its disruption early last year by law enforcement. Even so, the group “has teased its latest variant, LockBit 4.0, sending out the message that it’s not backing down,” it said. Whether or not LockBit is bluffing remains unclear.

Looking at victims listed on ransomware groups’ data-leak sites the leaders during the last three months of 2024 were RansomHub, followed by Play and Akira. Any analysis of leak site data comes heavily caveated: cyber criminals exaggerate their prowess and even when not embellishing their record, use leak sites as a way to publicly pressure victims who haven’t responded to initial entreaties with an extortion payment. Leak site data may simultaneously under- and over-report the number of victims.

The surge in claimed victims comes after blockchain analytics firm Chainalysis last August warned that ransomware profits for 2024 looked set to break records, following a record-breaking $1.1 billion in known profits in 2023. While fewer victims appear to be paying a ransom, the firm found that the median extortion payment jumped from nearly $200,000 in early 2023 to $1.5 million in June 2024 (see: Ransomware Again on Track to Achieve Record-Breaking Profits).

Clop Starts Naming Victims

More details pertaining to attacks from last quarter continue to come to light. The Clop – aka Cl0p – ransomware group this week listed 59 victims of the 66 it claimed to attack in December in an apparently semi-thwarted mass attack against users of managed file-transfer software built by Cleo Communications. Unlike some ransomware groups, Clop has shifted to extortion-only attacks, bypassing the step of maliciously encrypting data to just steal it and threaten its publication (see: Online Extortion Gang Clop Threatens Cleo Hacking Victims).

Some of the group’s claimed victims include Arizona-based supply chain management software provider Blue Yonder, Atlanta-based EspriGas in Atlanta, Phoenix-based Western Alliance Bank in Phoenix, Dutch software developer C3Group, Australian transport fuel supplier Ampol and Canada’s Polaris Transport.

These Numbers Can Lie

Counting the number of victims groups that run data-leak blogs list on their sites is one way of attempting to chart which groups remain in play and which ones are most active and pose the greatest risk. Whatever their favorite techniques for breaking into networks, organizations should ensure the right defenses to block them.

At the same time, ransomware groups regularly lie. Some list fake victims or cross-post victims with others. Nowhere do these groups ever disclose how many victims paid a ransom, never mind the amount. Also while groups often threaten to leak stolen data, whether they really stole data isn’t clear. Officials continue to warn that paying hackers for a promise to delete the data is foolish, and there’s no evidence that any attacker has ever honored such a promise.

Posting lists of victims who didn’t is marketing spin, playing into groups’ rampant self-promotion. Many run ransomware-as-a-service operations that rely on affiliates to steal data from victims and potentially deploy crypto-locking malware. Groups want to seem as big and bad as possible, both to attract the best business partners as well as to scare future victims into paying quickly and quietly.

It’s a Conti, Conti, Conti, Conti World

Despite such caveats, data leak sites can track the decline of ransomware brand, with case in point Conti spinoff group Black Basta, whose publicly claimed victims has plummeted.

Black Basta has appeared to be run as a well-structured business including bureaucratic mainstays such as office hours. Also, summer vacation from June through August. But it turned relatively quiet following a spate of attacks last April and May, perhaps hampered by not having a replacement for the Qbot, aka Qakbot, malware the group relied on until U.S. law enforcement disrupted it in August 2023, said RedSense’s Bohuslavskiy in a post to LinkedIn (see: Operation ‘Duck Hunt’ Dismantles Qakbot).

Even if Black Basta is facing serious problems, don’t expect the group to suddenly shut down. “Basta is likely cooperating with the Russian state – something that other post-Conti groups tend to avoid,” Bohuslavskiy said. “This cooperation will give them a runway for 2025, but the group may never restore the capabilities it had in the past.”

While Black Basta’s star appears to have been falling, fellow Conti spinoff Akira appears to have seen a surge “in activity during the same period, hinting at potential talent migration from Basta to Akira,” he said. That wouldn’t be the first time, with Akira appearing to have poached talent from LockBit following its disruption.

In terms of victims, Akira listed twice as many in the fourth quarter of 2024 as in the third quarter, including 71 alone in December 2024, ReliaQuest reported. Many of those attacks my trace in large part to the group’s exploitation of an improper access control vulnerability in SonicOS, patched last August and tracked as CVE-2024-40766, it said.

“To gain access to internal networks, Akira targeted local accounts with disabled multifactor authentication and SonicOS firmware versions vulnerable to exploitation, often exposed to the internet for virtual private network access,” it said. “Once inside, the attackers moved laterally, stole data, deployed ransomware and established backdoors for persistent access.”

Expect repeat attacks against SonicOS and other types of network edge devices, it said (see: Zero-Day Patch Alert: Ivanti Connect Secure Under Attack).