Information theft accounted for 94% of all cyber assaults worldwide in 2024, in line with new analysis, as cybercriminals more and more mix information exfiltration with encryption in ransomware campaigns.

Past encryption, ransomware attackers now threaten to leak or promote an organization’s information on the darkish internet if victims refuse to pay. Stolen info usually contains personally identifiable information and proprietary mental property.

The findings come from BlackFog’s 2024 Ransomware Development Report, which analysed ransomware exercise throughout tons of of publicly disclosed and non-disclosed assaults on international organisations between January and December.

The report discovered the common quantity of information stolen in an undisclosed exfiltration assault is 592 GB, and the variety of disclosed and undisclosed cyber assaults elevated by 25% and 26% year-over-year, respectively.

Dr. Darren Williams, founder and chief govt officer of BlackFog, mentioned in a press launch: “The report reveals 2024 was a landmark yr with organizations going through rising monetary and reputational harm from ransomware assaults, with high-value sectors notably pressured to pay ransoms to revive operations.”

In line with IBM’s Value of Information Breach report, the common price of a ransomware assault involving information exfiltration in 2024 was $5.21 million.

“As cybercriminals constantly refine their methods to take advantage of vulnerabilities and launch large-scale assaults, defending in opposition to ransomware is changing into more and more advanced,” Dr. Williams added. “Governments are stepping up efforts to counter this rising risk, introducing new measures resembling obligatory ransomware incident reporting. Nevertheless, the worldwide ransomware disaster continues to escalate at an alarming price.”

Ransomware attackers are more and more drawn to official enterprise instruments

In September 2024, safety researchers found a double-extortion ransomware variant concentrating on VMware ESXi servers, which each copied and encrypted the goal’s information. Ransomware teams have additionally been exploiting official file switch know-how to safe assaults.

SEE: Microsoft Says Ransomware Teams Are Exploiting the Newly-Patched VMware ESXi Flaw

BlackFog reported that PowerShell was utilized in 56% of ransomware instances in 2024, highlighting how attackers are more and more “leveraging official instruments and platforms to infiltrate networks, set up a presence, and exfiltrate information with out triggering alarms from many endpoint safety platforms.”

High focused industries face relentless strain

The manufacturing, companies, and know-how sectors noticed the best variety of undisclosed assaults, and are often-cited as extremely focused as a result of vital nature of their uptime, excessive ranges of digitisation, and huge volumes of delicate information.

For disclosed assaults, healthcare, authorities, and training have been essentially the most focused, accounting for 47% of all ransomware-related information headlines in 2024. The most important surge was seen within the retail sector the place disclosed assaults spiked by 96% with high-profile victims together with Starbucks, Sainsbury’s, Morrisons, London Medicine, and Krispy Kreme.

Ransomware teams: Outdated leaders persist, new gamers emerge

LockBit remained essentially the most lively ransomware group, attacking 603 reported victims. This was regardless of a significant regulation enforcement takedown in February 2024, led by the U.Okay. Nationwide Crime Company’s Cyber Division, the FBI, and different worldwide companions. The operation quickly disabled LockBit’s ransomware-as-a-service platform, however the group resumed operations days in a while a brand new darkish internet area.

Nonetheless, funds to LockBit decreased by 79% within the second half of the yr, in line with separate analysis from Chainalysis.

BlackFog’s report recognized RansomHub because the second-most lively ransomware group of 2024. A relative newcomer, it emerged in February 2024 and rapidly gained notoriety with assaults on international producer Kawasaki and oil and gasoline companies firm Halliburton.

Medusa and Play ranked third in disclosed and undisclosed incidents, respectively.

Surge in new ransomware teams fueled by AI

A Cyberint report from October discovered that Q2 2024 had the best variety of lively ransomware teams on document, as smaller, newer teams entered the scene.

In January 2024, the U.Okay.’s Nationwide Cyber Safety Centre warned that the risk of ransomware was anticipated to rise as a result of new availability of AI applied sciences lowering the barrier to entry, enabling even inexperienced criminals to conduct subtle assaults.

BlackFog’s analysis strengthened these findings, reporting that 48 new ransomware teams emerged in 2024, marking a 65% enhance from the variety of new variants from the earlier yr. Greater than half of all ransomware assaults within the final two months of 2024 have been carried out by these newly shaped teams.