Malwarebytes’s ThreatDown 2024 State of Ransomware report shows that there have been significant shifts in the tactics and strategies employed for ransomware attacks by cybercriminals.
Three key shifts in the tactics and techniques of ransomware gangs that were identified are:
- Living off the Land (LOTL) techniques: ransomware gangs are increasingly relying on built-in system administration tools to carry out their attacks, making detection and prevention more challenging for teams without a dedicated security operations center (SOC).
- Nighttime attacks: most ransomware attacks now occur between 1 a.m. and 5 a.m., targeting organizations when IT staff are less likely to be present.
- Faster attack timelines: the entire ransomware attack chain, from initial access to data encryption, has reduced from weeks to mere hours, necessitating rapid detection and response capabilities.
Other key findings from the report include:
- The US experienced a dramatic 63% increase in ransomware attacks in the report period, with the UK seeing an even greater rise of 67%.
- The share of attacks carried out by gangs outside the top 15 increased from 25% to 31%, indicating that ransomware is becoming more accessible to a broader range of cybercriminals.
- The US accounts for 48% of all ransomware attacks worldwide but suffers 60% of the world’s attacks on education and 71% of attacks on healthcare.
- The manufacturing sector saw a 71% year-on-year increase in ransomware attacks.
