2024 saw a record number of ransomware victims, according to an annual report from GuidePoint Research and Intelligence Team (GRIT).

The number of publicly posted ransomware victims reached 4,848, with a high in Q4 of 1,600.

The record setting figure is despite a slump in ransomware cases over Q2 and Q3, likely the result of the disruption of major ransomware gangs LockBit and Black Cat.

The number of ransomware attackers also reached a new high, however, with a 40% increase in active threat groups since last year.

The total number of attacks came from a range of gangs and was less dominated by top groups, pointing to the diversifying ecosystem.

While security professionals expected more of a lull in mid 2024 thanks to the disruption of LockBit and Black Cat, the rise of RansomHub kept them on their toes, contributing to the sustained ransomware threats over the year.

2024’s Q3 and Q4 also did not suffer the same slump seen in the last two years, with Q4’s record setting claimed ransomware victims likely driven by newcomer gang Funksec and the return of Clop.

Recommended reading

• Report: Vulnerability Exploitation Surge Endangers Cybersecurity
• UK Proposes Ban on Public Sector Ransomware Payments
• Comment | Cybersecurity Ethics in an Age of Evolving Cyber Risk

Over the course of last year, manufacturing was the most targeted industry by ransomware groups, as observed by GRIT. 67% of the tracked ransomware groups claimed at least one victim within the industry last year.

Banking and finance saw a relative decrease in the number of ransomware victims, with a near 25% drop in observed attacks (245 vs 185).

While the United States was the most targeted country by far (51.53%), the UK (4.97%) and Canada (4.95%) trailed far behind.

In terms of vulnerabilities which ransomware groups can exploit, 2024 saw an explosion of different common vulnerabilities and exposures (CVEs).

There were 3,900 published CVEs over the year, nearly a 40% increase from 2023. A high level of these CVEs presented substantial risks, and with an average of 378 CVEs published a day, organisations were drowning in potentially exploitable vulnerabilities.