Ransomware Extortion Drops to 135M in 2024: A Year of Shifting Tactics and Declining Payments

2025-02-11

Ransomware attacks have long been a lucrative endeavor for cybercriminals, but in 2024, a significant drop in the total amount extorted marked a shift in the landscape of cybercrime. The total ransom paid out in 2024 was $813.5 million, a sharp decline from $1.25 billion in 2023. This decline is notable, especially as it coincided with an uptick in ransomware events during the second half of 2024. Despite more victims being targeted, the total payments fell, revealing important shifts in both attacker strategies and victim responses.

Blockchain intelligence firm Chainalysis tracked the changing trends, reporting that ransomware payments during the first half of 2024 amounted to $459.8 million. However, by mid-year, there was a sharp decrease of approximately 3.94% in payments, even as the number of attacks continued to rise. This is indicative of victims becoming more reluctant to pay ransoms or better prepared to mitigate the impact of such attacks. Additionally, the fragmentation of the ransomware ecosystem, particularly following the collapse of major players like LockBit and BlackCat, contributed to the rise of new actors targeting smaller and mid-sized entities. These actors, in contrast to previous “big game” hunters, often demand lower ransoms.

The figures show a slight increase in average ransomware payments—$553,959 in Q4 2024 compared to $479,237 in Q3. However, the median payment decreased from $200,000 to a lower figure, indicating that while some larger victims may still be paying large sums, many others are choosing not to comply with ransom demands at all. This evolving trend presents new challenges for both attackers and defenders in the cybersecurity space.

What Undercode Say: Analyzing the Shifting Ransomware Landscape

The dramatic decline in ransomware extortion revenue from $1.25 billion in 2023 to $813.5 million in 2024 is a noteworthy shift in the ongoing battle between cybercriminals and organizations worldwide. At first glance, the reduction in total payments might suggest that cybercriminals are losing their grip on victims, but this is far from the complete picture. The landscape is becoming more complex, and several factors are at play.

Firstly, the increase in the number of ransomware events during the second half of 2024—coupled with the 3.94% drop in on-chain payments—hints that while attackers are successful at infiltrating networks, their victims are increasingly less likely to pay. This is a trend we’ve seen in the last few years, where organizations, bolstered by better cybersecurity infrastructure and response protocols, are opting to either restore data from backups or endure the financial and operational hits rather than succumb to ransom demands.

One of the most interesting aspects of this evolution is the increasing fragmentation of the ransomware ecosystem. With major players like LockBit and BlackCat either disbanding or losing influence, new groups have emerged, targeting smaller to mid-sized organizations. This shift indicates a change in strategy from high-profile, high-stakes attacks against large corporations to smaller, more frequent attacks against a larger number of victims. The result? Lower ransom demands. While some may interpret this as a sign of weakening ransomware groups, it also opens up new opportunities for these actors, who can exploit gaps in the security frameworks of less well-prepared businesses.

It’s clear that cybercriminals are adapting. The lower ransom payments in Q4—though still significant—indicate that the cybercriminal model is shifting. Attackers may be lowering their expectations as they target smaller businesses that cannot afford to pay hefty ransoms but still provide opportunities for some level of extortion.

The increasing fragmentation is also reflective of a wider trend in cybercrime: decentralization. Ransomware groups, now operating in more dispersed, independent factions, may have fewer resources but are more agile in executing attacks. This decentralization makes it harder for law enforcement and cybersecurity teams to track and dismantle these groups, which presents ongoing challenges for both defense strategies and international cooperation in fighting cybercrime.

Furthermore, as more groups embrace small to mid-sized targets, the nature of ransomware attacks could become less visible in the media. High-profile cases involving major corporations may drop, but there will be an increase in smaller, less-publicized attacks. This shift may make it harder for the public and organizations to gauge the real impact of ransomware, despite the ongoing threat it poses.

Another notable element is the rise in the average ransom payments, even as the median has fallen. This indicates a possible stratification of ransom demands: while most small businesses may pay less, large organizations or those with critical infrastructure may still face exorbitant demands. The rise in average payments may be a reflection of these outlier cases where victims choose to pay to avoid catastrophic operational disruptions, as seen with attacks on healthcare systems, government agencies, and other high-priority sectors.

The ransomware ecosystem is undeniably evolving, and while it’s tempting to view the decline in total ransom payments as a sign of progress, the reality is far more complex. The focus is shifting to new targets and more subtle extortion tactics, meaning the war against ransomware is far from over. The key takeaway for organizations is clear: proactive defenses and preparedness are crucial. The best way to mitigate the risk of a successful attack is not to hope that the attackers will go away, but to invest in robust security measures that can make an organization a harder target.

References:

Reported By: https://thehackernews.com/search?updated-max=2025-02-10T10:44:00%2B05:30&max-results=11
https://www.pinterest.com
Wikipedia: https://www.wikipedia.org
Undercode AI: https://ai.undercodetesting.com