- FinCEN reports that ransomware activity decreased in 2024 following the closure of ALPHV and LockBit.
- 2023 was a record year with $1.1 billion in payments; In 2024, there were 1,476 incidents and payments worth $734 million
- Collapsed Gangs (ALPHV, LockBit, Black Basta) earned $790 million; Akira remains the most active, focusing on finance, manufacturing and healthcare.
The removal of the ALPHV and LockBit ransomware groups has had a significant impact on the overall performance of ransomware operations over the past year.
This is according to data from the Treasury Department’s Financial Crimes Enforcement Network (FinCEN), which recently showed that the number of ransomware infections and paid ransoms fell in 2024, after reaching a record high in 2023.
The analysis of financial trends confirmed that 3,075 cases of ransomware infections were reported between 2013 and 2021, with victims paying $2.4 billion in ransoms.
Three key players are missing
Between January 2021 and December 2024, there were 4,194 such attacks and payments totaling $2.1 billion. 2023 was the peak year. About $1.1 billion in sales this year, an increase of 77% from last year. The most active groups of this era included ALPHV (also known as BlackCat), Akira, LockBit, Black Basta and Phobos.
Then the police intervened. ALPHV and LockBit folded, while Black Basta imploded due to loss of internal communications. Results: In 2024, there were “only” 1,476 incidents (compared to 1,512 the year before) and approximately $734 million in payments.
The average ransomware payout in 2023 was $174,000, significantly higher than $124,097 in 2022 and $155,257 in 2024.
The three collapsed groups (ALPHV, LockBit and Black Basta) together generated almost $790 million during the analyzed period. Akira, who was active today, accounted for the most attacks (376), while ALPHV and LockBit had around 353 each. The hardest hit sectors were financial services, manufacturing and healthcare.
Almost all payments (97%) were made in Bitcoin, which the gangs sent to unregulated cryptocurrency exchanges and mixing/tumbling services for money laundering purposes.
IN the file