Last year saw a sharp decline in the number of ransomware payments made by victims, falling by more than $436 million (£350m) from the record-breaking levels of 2023, according to new figures from Chainalysis.

The blockchain analytics firm’s latest ransomware report found a 35% year-on-year decrease in ransomware payouts, driven largely by international law enforcement operations which saw major ransomware gangs disrupted, including the Russia-linked Evil Corp group and LockBit.

Chainalysis’ data shows that in 2024, ransomware attackers received in the region of $813.5 million (£653.6m), falling by more than a third from 2023’s $1.25 billion (£1bn), despite the first half of last year seeing some exceptionally large payouts, such as the $75 million (£60.2m) handed over to the Dark Angels group.

However, the second half of 2024 saw a swift dropoff in ransomware activities, with Chainalysis noting that the decline was more pronounced than any period over the past four years, a result of improved international collaboration and the collapse of the high profile ALPHV/BlackCat group.

“The market never returned to the previous status quo following the collapse of LockBit and BlackCat/ALPHV,” said Lizzie Cookson, senior director of incident response at Coveware, a ransomware incident response firm.

“We saw a rise in lone actors, but we did not see any group swiftly absorb their market share, as we had seen happen after prior high profile takedowns and closures. 

“The current ransomware ecosystem is infused with a lot of newcomers who tend to focus efforts on the small- to mid-size markets, which in turn are associated with more modest ransom demands.”

Incident response data shows the gap between the amounts demanded and actual ransomware payouts has continued to increase, with a 53% difference between the two in H2 2024, and reporting from incident response firms suggesting a majority of clients are opting not to pay altogether.

“According to our data, around 30% of negotiations actually lead to payments or the victims deciding to pay the ransoms,” said Dan Saunders, Director, incident response, EMEA at Kivu Consulting.

At first glance, last year’s numbers seem to reveal a growing refusal by victims to pay, with more victims being posted online than ever previously recorded – and fifty-six new data leak sites springing up over the year.

According to Chainalysis, however, those figures don’t tell the whole story.

Following the collapse and disruption of larger ransomware gangs, those left intact or trying to rebuild were found to be overstating their claims. As an example, the report highlights how, in the aftermath of Operation Cronos, what remained of the LockBit group began reposting previously listed claims and adding attacks that happened up to a year before.

“We have observed leak site posts claiming organizations, only to fail on a deeper analysis,” said Corsin Camichel, threat researcher at eCrime.

“We have seen claims for multinational organizations, but in reality, only a smaller subsidiary was impacted. More than 100 organizations got listed on two or more data leak sites in 2024.”

Recommended reading

• Report: Vulnerability Exploitation Surge Endangers Cybersecurity
• UK Proposes Ban on Public Sector Ransomware Payments
• Comment | Cybersecurity Ethics in an Age of Evolving Cyber Risk

Despite the evasiveness and mixed motives of those in ransomware gangs, recent research from security platform provider Illumio is evidence of their impact.

In a study of the global costs associated with ransomware incidents, Illumio found that 58% of businesses hit by ransomware attacks have been forced to shut down operations to recover, losing revenue, customers, and staff in the fallout.