That stated, CL0P’s exercise solely accounted for round 9% of the info leak posts in 2023, positioning it in third place after BlackCat (ALPHV) with virtually 10% and LockBit with 23%. LockBit, a ransomware-as-a-service (RaaS) operation that gathered many associates after teams like Conti, Hive and Ragnar Locker shut down, has been probably the most prolific ransomware group two years in a row.
Ransomware group newcomers and goners
New teams additionally performed an enormous function within the ransomware exercise spike, organising 25 new leak websites that accounted for 25% of the full variety of sufferer posts. A few of these teams have been lively since 2022 however didn’t have leak websites till 2023. 5 had no exercise within the second half of the 12 months, so it’s not clear if they’re nonetheless lively or they’ve already disbanded. Nonetheless, others stay lively, and the highest ones are Akira and 8Base, every of them with virtually 200 posts.
Akira is a bunch that was first noticed in March 2023 and has suspected hyperlinks to the previous management of the Conti group primarily based on noticed cryptocurrency transactions. 8Base has been lively since 2022 however didn’t disclose any victims till Might 2023.
Final 12 months has additionally been busy for legislation enforcement within the ransomware house with a number of actions which have led with distinguished teams shutting down or struggling important disruptions. It began with a US Federal Bureau of Investigation (FBI) operation that dismantled the Hive command-and-control community in January 2023. In October, an Europol-coordinate worldwide motion noticed the seizure of the Ragnar Locker infrastructure and in December the FBI disrupted the operations of BlackCat (ALPHV) and launched a decryption key. The BlackCat group has not disbanded but it surely’s not clear if it could restore its fame within the cybercriminal underground.
The Palo Alto Networks researchers additionally point out the potential rebranding of two different notable teams: Royal which stood out in 2022 with assaults in opposition to vital infrastructure targets and which researchers believes has since rebranded into BlackSuit primarily based on code similarities, and Vice Society, a bunch that attracting consideration to itself by concentrating on healthcare and schooling organizations and which a number of researchers have linked to the brand new Rhysida ransomware.
Manufacturing was the business most focused by ransomware
The ransomware sufferer distribution reveals that manufacturing was probably the most impacted sector, accounting for 14% of the info leak posts. This was adopted by skilled and authorized companies, high-tech, wholesale and retail, development, healthcare, monetary companies and schooling.
By geographic distribution, virtually half of the victims have been primarily based within the US, 6.5% within the UK, 4.6% in Canada, 4% Germany, and three.4% in France. “The US presents a really engaging goal, particularly when inspecting the Forbes World 2000, which ranks the biggest corporations on the planet based on gross sales, earnings, belongings and market worth,” the researchers stated. “In 2023, the US accounted for 610 of those organizations, consisting of just about 31% of the Forbes World 2000, indicating a excessive focus of rich targets.”
