- FinCEN reports ransomware activity declined in 2024 after ALPHV and LockBit takedowns
- 2023 was a peak year with $1.1 billion. in payments; In 2024, there were 1,476 incidents and $734 million paid
- Collapsed Gangs (ALPHV, LockBit, Black Basta) Earned $790M; Akira remains most active, targeting finance, manufacturing and healthcare
The removal of the ALPHV and LockBit ransomware gangs made a solid dent in the overall performance of ransomware operations last year.
This is according to the Treasury Department’s Financial Crimes Enforcement Network (FinCEN), which recently said that after all-time highs in 2023, the number of ransomware infections and paid ransoms declined in 2024.
In its “Financial Trend Analysis” paper, it confirmed that between 2013 and 2021 there were 3,075 reported cases of ransomware infections, with victims paying $2.4 billion in ransom demands.
Three key players out of the picture
Between January 2021 and December 2024, there were 4,194 such attacks and $2.1 billion in payments. 2023 was a peak year. That year, about $1.1 billion exchanged hands, which was a 77% increase over the previous year. Some of the most active groups at the time were ALPHV (AKA BlackCat), Akira, LockBit, Black Basta and Phobos.
That’s when law enforcement stepped in. Both ALPHV and LockBit were taken down, while Black Basta imploded after internal communications were leaked. As a result, there were “just” 1,476 incidents in 2024 (down from 1,512 the year before) and about $734 million in payments.
The average ransomware payment in 2023 was $174,000, significantly more than $124,097 in 2022 and $155,257 in 2024.
The three groups that collapsed – ALPHV, LockBit and Black Basta collected almost $790 million between them during the analyzed period. Akira, which is active today, was responsible for the largest number of attacks (376), while ALPHV and LockBit each had around 353. Financial services companies, manufacturing companies and the healthcare industry were the most targeted sectors.
Almost all of the payments (97%) were made in Bitcoin, which the gangs sent to unregulated cryptocurrency exchanges and tumbling/mixing services to launder.
Via The record
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
