Last year saw an upsurge of law-enforcement takedowns of some notable ransomware threat groups, but other trends were not as uplifting

In summarizing the data trends in its user protection ecosystem in 2023, Palo Alto Networks has released some key findings about ransomware incidents encountered.

First, the manufacturing industry had been a prime target for ransomware, consisting of a 49% year-on-year surge in multi-extortion ransomware attacks worldwide between 2022 and 2023. Of note were organizations in the manufacturing sector in ASEAN and Singapore, which had experienced the highest incidence of these attacks in 2023.

Second, of the 3,998 leak-site posts from 2023 globally, LockBit ransomware remained the most active, with 928 organizations accounting for 23% of the total. LockBit was also the most active group in the Asia Pacific region (note: this was before the recent disruption of LockBit by law enforcement agencies).

The third finding was that data from the firm’s Incident Response teams showed an evolution in extortion tactics, with a significant rise in harassment cases post-ransom payments (double-threat ransomware).

Finally, the year’s data showed that the dynamics of ransom payments had shifted: despite an increase in ransom demands in 2023, organizations in the firm’s protection system had increasingly opted for incident response teams equipped with negotiation capabilities, resulting in decreased payouts.

Overall, although companies from at least 120 different countries had been impacted by ransomware extortion, those from the USA stood out as the primary targets, featuring in 47% of ransomware leak-site posts in 2023.

In the executive summary of the 2023 report by Palo Alto Networks, attention was also drawn to high-profile vulnerabilities such as SQL injection (MOVEit and GoAnywhere managed-file transfer services); Zero Day exploits by groups like CL0P, LockBit and ALPHV (BlackCat); and the appearance and quick disappearance of new threat groups such as Darkrace, CryptNet and U-Bomb. Additionally, although the landscape was fluid, the growing effectiveness of law enforcement agencies in combating ransomware signals were a welcome change during the year.