Threat Snapshot 2 Blurring Boundaries 3 Vulnerability Intelligence 4 Stolen Access Credentials 6 Tips 7 21 Ransomware 5 Key Findings 1 As previously mentioned, the most notable new group that emerged in 2024 is the RansomHub gang, which in the wake of the law enforcement seizures and shutdowns of the LockBit gang’s infrastructure, rose to prominence as the most active ransomware gang in 2024, claiming 612 victims, which constitute almost 10% of the total number of claimed victims detected in 2024. Throughout 2024, a total of 44 new groups that emerged and started their operations in 2024 were identified. These new ransomware gangs claimed responsibility for targeting 1,880 victims in total, which constitutes 30.6% of all claimed victims published in ransomware gangs’ dark web sites in 2024. As the data above shows, 2024 saw an increase in the number of ransomware attacks. However, according to researchers, the amount of ransomware payment, $813.55 had declined by 35% since 2023 ($1.25 Billion). This decline occurred in the second half of 2024 and was mostly due to the takedown of Lockbit and the disappearance of AlphaV (BlackCat) ransomware groups. The number of new groups that appeared in 2024, does not seem to be at the same level as the two. This can also be observed in the discrepancy between the ransom demanded and the amount paid, which stands at 53%. This difference is partly because many ransomware groups were able to steal only data that was either insignificant or outdated, which was left on unsecured servers. Additionally, it reflects the improved preparedness of organizations in defending against ransomware attacks. 27 was actually reposted from victims of other ransomware gangs from previous attacks, including Clop, Hunters International and 8Base. The Dispossessor gang’s operations were shut down in August 2024 by the FBI and other law enforcement agencies, who reported that the list of identified victims includes as many as 43 victims, thus confirming the actual number of victims is lower than the number claimed by the Dispossessor gang, and that most of the victims listed on Dispossessor’s website are indeed “recycled”. Ransom Hab 612 victims Killsec 133 victims AzzaSec RaaS Handala 53 victims APT73 66 victims Dark Vault 53 victims Arcus Media 58 victims El Dorado 107 victims Fog 86 victims Lynx 86 victims FunkSec 104 victims February March March April April May June June July December Timeline of Emergence of the 10 Most Active New Ransomware Gangs in 2024 Threat Snapshot 2 Key Findings 1 Blurring Boundaries 3 Stolen Access Credentials 6 Tips 7 Ransomware 5 Ransomware 5 Vulnerability Intelligence 4