2024 is expected to be the highest-grossing year for ransomware payments yet, raking in a record $459.8 million (£353.24m) in the first half of 2024.

This is a year-on-year increase of 2%, but last year’s analysis showed that ransomware payments reached a record-breaking $1.1bn (£850m). The first half of 2024 has already exceeded the figures of the first half of 2023, which saw ransomware payments amounting to $449.1m (£345m).

2024 has already seen the largest ransomware payment ever recorded, at $75 million (£57.62m), collected by the Dark Angels ransomware group.

Chainanalysis, which tracked the ransomware payments, claim that the rise in payments is likely due to ransomware gangs opting for “big game hunting” – a method of conducting less overall attacks, but going for the largest payments possible.

This tactic saw the median ransom payment spike from $200,000 (£154,000) in early 2023 to $1.5m (£1.15m) in mid-June 2024. Ransomware gangs are targeting larger businesses and critical infrastructure providers that would be more likely to pay higher ransoms due to their systemic vitality and their larger resource pools.

The rise in ransomware payments is even despite law enforcement cracking down on some of the industry’s largest players, including LockBit and Black Cat. However, LockBit is already back in action after being taken down, but many affiliates have been forced to start their own strains, or join less lucrative ones.

“Whether it be former affiliates of these well-known threat actor operations, or new upstarts, a large number of new ransomware groups have joined the fray, displaying new methods and techniques to carry out their attacks such as expansion in their means for initial access and lateral movement approaches,” Andrew Davis, general counsel at Kiva Consulting, commented on the continued ransomware trends despite law enforcement efforts.

Recommended reading

• UK Businesses Face New Cyber-attacks Every 44 Seconds in Q2 2024
• Ransomware Crisis Escalating Globally, New Report Shows
• What Were the Key Ransomware Trends in July?

The research also found that the number of confirmed ransomware attacks increased by 10% year on year in 2024, with a similar rise in the number of victims published on the dark webs.

Despite a rise in attacks, Chainanalysis found that ransoms are being paid less often. While posts to ransomware leak sites have also increased by 10% YoY, payment events measured on-chain (as in, on the blockchain) have gone down by 27.29% YoY.

“Approximately 65% of the matters in which Kivu has been engaged in to assist victim organizations have resolved without a resulting payment of the ransom, continuing the positive trend of resiliency on the part of impacted organizations and a lack of necessity to pay the attackers,” Davis commented.