2024 Annual Crimeware Report 

The report leverages data collected from Arete’s response to ransomware and extortion attacks throughout 2024 and offers analysis and insights on shifts in the threat landscape, including the most observed threat groups, trends in ransom demands and payments, industries targeted by ransomware attacks, and what may be coming next. 

Key Findings

• Victim organizations continued to demonstrate an improved capability to recover from attacks without paying ransom demands.  

• Threat actors adapted to the increase in law enforcement pressure, with new threat groups rapidly emerging, partnerships forming between groups, and an air of distrust enveloping the threat landscape. 

• Most ransomware and extortion activity in 2024 was opportunistic in nature, with threat actors targeting certain technologies or exploiting vulnerabilities as opposed to focusing on a specific industry.

Explore data and insights from the frontlines of incident response, including median demands and payments, notable threat actor TTPs, the most impacted industries, and frequently observed malware and tools.  We are dedicated to protecting our clients, informing our partners, and contributing to the shared fight against cyber extortion.