Ransomware Threats Persist Despite Law Enforcement Efforts, Revealing New Challenges for Cybersecurity

The Corvus Threat Intelligence report from January 30, 2024, provides a comprehensive overview of ransomware trends in 2023. Notably, there was a 7% decrease in ransomware leak site victims in Q4 compared to Q3, but an alarming 69% increase year-over-year. This suggests that while law enforcement actions have had some impact, ransomware continues to be a significant threat.

A key development in 2023 was the 34% increase in active ransomware groups, from 35 to 47. This growth was partly due to the leaking of ransomware encryptors on the dark web and the formation of new splinter groups from larger, defunct organizations. Despite the takedown of the Qakbot malware network and disruptions to groups like ALPHV/BlackCat, threat actors demonstrated resilience by quickly adopting alternative malware like Pikabot and DarkGate.

The report also highlights the critical role of exploiting external vulnerabilities, which contributed to record-breaking ransomware activity in 2023. For instance, vulnerabilities in VMware ESXi servers and Fortra’s GoAnywhere software were exploited, leading to a significant number of victims. This trend of rapid exploitation of vulnerabilities continued into Q4, posing major challenges for cybersecurity teams.

Industry trends showed a steady increase in ransomware attacks on law practices and the transportation, logistics, and storage industry. These sectors are particularly vulnerable due to the high stakes involved in business interruptions.

In conclusion, the report underscores the resilience of cybercriminals and the ongoing challenges faced by businesses in securing their networks against ransomware. Despite law enforcement efforts, the threat landscape continues to evolve, emphasizing the need for businesses to strengthen their cybersecurity defenses and focus on resilience in 2024.