Ransomware Attacks Rise Again: What’s Fueling the Surge?

Ransomware attacks rise again: Key factors behind the resurgence

In 2024, the number of ransomware attacks is climbing again after a brief decline, with Lockbit, Hiveleaks, and BlackBasta leading the charge. According to NCC Group, which actively monitors leak sites to collect attack data, Lockbit alone executed 62 attacks in July. This represents a staggering 440% increase for Hiveleaks and a 50% increase for BlackBasta since June. Why are we seeing such a rapid rise in ransomware incidents, and what should organizations do to protect themselves?

1. Ransomware-as-a-Service (RaaS) resurgence

Ex-Ransomware-as-a-Service (RaaS) groups are back in the game, and many have adapted their models to become more difficult for organizations to defend against. RaaS groups like Lockbit 3.0 have updated their ransomware packages, providing them to affiliates who launch attacks for a cut of the profits.

This decentralized business model means even small-time hackers can execute sophisticated attacks. For instance, Lockbit’s model helped it conduct ten times more attacks in July than in December. If attackers can use updated ransomware with a low technical barrier, it’s clear why the RaaS ecosystem has gained renewed momentum.

Related Link: Phishing Simulator – Explore how phishing simulators can strengthen defenses against RaaS-driven phishing attacks.

2. Increased reliance on leak sites and data monetization

Ransomware groups have refined their methods for monetizing stolen data. Leak sites have become crucial to their extortion methods, often creating more pressure for victims to pay. By threatening to publish sensitive information, attackers force companies to consider the reputational and financial repercussions of data leaks.

NCC Group’s data collection from these leak sites illustrates how integral these sites have become. If ransom is unpaid, the attackers release the data publicly, amplifying the risk of regulatory penalties for businesses and increasing payout rates. This tactic has quickly become a primary way for ransomware groups to turn breached data into profits.

Related Link: Keepnet Human Risk Management Platform – Learn how to monitor human risk factors that contribute to ransomware exposure.

3. Double and triple extortion tactics

A sharp rise in double and triple extortion tactics has made ransomware attacks more potent. In double extortion, attackers encrypt data and threaten to release it publicly. In triple extortion, attackers increase pressure by contacting clients or suppliers of the breached organization. This expanded extortion approach increases the likelihood of payouts, motivating ransomware groups to push for even greater intensity in their operations.

Related Link: Security Awareness Training – Empower your employees to recognize ransomware risks before an attack escalates.

4. Exploiting supply chain and third-party vulnerabilities

In the face of heightened security measures, ransomware groups have turned their focus to supply chain vulnerabilities. Attackers increasingly target third-party vendors or partners with weak security practices, which often serve as backdoor entry points to larger companies. This tactic has proven successful for groups like BlackBasta and Hiveleaks, both of which saw significant growth in July by leveraging these alternative entry points.

Related Link: 10 Essential Tips to Protect Yourself from Phishing Attacks – Understand critical techniques to prevent breaches in your network.

5. Advanced automation and AI in attacks

Incorporating AI and automation, ransomware groups are enhancing the precision and speed of attacks. With AI-driven scanning and automated vulnerability detection, ransomware groups can pinpoint the most vulnerable organizations quickly, enabling them to launch more attacks simultaneously.

This technology-driven approach has led to unprecedented growth for groups like Lockbit, which are now executing large-scale attacks that evade traditional security measures.

Related Link: What is Spear Phishing and How to Prevent It – Learn how AI is impacting spear phishing attacks and best practices for defense.

6. Law enforcement challenges and international factors

Many ransomware groups operate from countries with limited law enforcement collaboration, giving them freedom to operate with little interference. As ransomware groups have become highly organized and resourceful, they continue to evade capture, especially in jurisdictions with minimal regulation of cybercrime.

This lack of enforcement allows groups like Lockbit, Hiveleaks, and others to act boldly and remain active players in the ransomware landscape.

Related Link: Discovering Keepnet Labs Data Breaches Solutions – Explore Keepnet’s data breach solutions designed to mitigate ransomware risks.

7. Competition among cybercrime groups

Ransomware groups are not only targeting organizations—they’re competing with each other for dominance. Hiveleaks and BlackBasta, each with a 440% and 50% attack rate increase respectively, have ramped up operations in response to Lockbit’s aggressive tactics. As each group works to establish dominance, the outcome is a sharp increase in attack rates across the board.

This competitive dynamic further incentivizes groups to develop unique attack methods and escalate their efforts, putting organizations at heightened risk of ransomware attacks.

Related Link: Cybersecurity Awareness Training – See how comprehensive training can counteract even advanced tactics by ransomware groups.

How can organizations defend themselves?

The recent surge in ransomware attacks signals the need for a multi-faceted defense strategy. Organizations can take several steps to protect themselves against the escalating threat:

• Implement multi-layered security protocols that cover both internal and third-party access points.
• Train employees regularly with security awareness training to detect phishing and ransomware attempts.
• Back up data frequently and test restore capabilities to mitigate damage in case of a successful attack.
• Invest in incident response planning to contain breaches before they escalate.

With robust cybersecurity practices in place, businesses can reduce their vulnerability and respond effectively to ransomware attacks.

Editor's Note: This blog was updated on November 15, 2024.