Threat Snapshot 2 Blurring Boundaries 3 Vulnerability Intelligence 4 Stolen Access Credentials 6 Tips 7 20 Ransomware 5 Key Findings 1 LockBit, which was the most prolific and active ransomware family in 2023, was pushed to 2nd place following a global law enforcement takedown campaign known as “Operation Cronos” that took place in February 2024. 25 The participating law enforcement agencies disrupted LockBit’s operations by seizing the gang’s websites and dismantling its infrastructure. The operation also led to the indictment and arrest of some of its operators and affiliates. While the gang set up a new website shortly after the seizure, it has not managed to restore its previous status as the leading ransomware group. Nonetheless, the gang has still demonstrated some degree of resiliency, and in late 2024, it announced its plans to launch the new Lockbit 4.0 version of its malware. The RansomHub ransomware gang filled the void left by the LockBit seizure, becoming the most active group in 2024. RansomHub became active starting in February 2024 and listed a total of 612 victims on its dark web data leaks and extortion website as of the end of 2024. Impact of Law Enforcement Operations The Dispossessor gang is an unexpected name on the list of top ransomware gangs, as it is less familiar and has made less headlines than the other gangs on the list. The Dispossessor (also known as Radar) ransomware first emerged in August 2023. 26 Researchers noted that the gang bears similarities to the LockBit gang, and it is suspected as having ties to former affiliates of LockBit. While the gang published 344 victims on its website in the past year, the leaked data Most Active Ransomware Gangs in 2024 (by number of claimed victims) Ransomhub Lockbits Play Dispossessor Akira Hunters Medusa Qilin Blackbasta Bianlian 612 538 367 344 317 235 214 186 185 169 Threat Snapshot 2 Key Findings 1 Blurring Boundaries 3 Stolen Access Credentials 6 Tips 7 Ransomware 5 Ransomware 5 Vulnerability Intelligence 4