Key Points

• Ransomware activity grew by 2.3% in Q3 2024 compared to the previous quarter but remains 1.5% lower than in Q3 2023.
• “RansomHub” overtook “LockBit” as the most active group, with an 800% surge in activity, likely attributable to its attractive 90/10 profit split for affiliates.
• “Meow” took fourth place in Q3 2024, shifting its tactics from data encryption to selling stolen data on cybercriminal forums and its own data-leak site.
• Major developments this quarter include “Play” transitioning from double-extortion tactics to targeting ESXi environments and the cybersecurity firm Fortinet experiencing a data breach in which 440GB of customer data was compromised.
• In the short term, we expect a gradual increase in ransomware incidents, peaking by Q4 2024. This will likely be driven by innovative groups like “RansomHub” and “Inc Ransom.” In the long term, we anticipate a greater use of large language models (LLMs) in ransomware negotiations and a rise in exfiltration-only attacks.

In Q3 2024, ReliaQuest identified 1,266 organizations listed on ransomware data-leak sites, up from 1,237 in Q2 2024. This quarter’s increased activity from up-and-coming ransomware-as-a-service (RaaS) providers like “RansomHub” and “Play” (aka PlayCrypt) likely results from law enforcement actions, including an operation against the former leading group “LockBit,” which disrupted the RaaS ecosystem and caused ransomware groups to compete for affiliates.

RansomHub, now the most active ransomware group, has significantly upped its game by teaming up with the hacking group “Scattered Spider.” Together, they use native English speakers to execute sophisticated social engineering operations, contributing significantly to their newfound dominance.

Despite the recent surge from these groups, ransomware activity in Q3 2024 has decreased by 1.5% compared to Q3 2023. This continued slowed growth that began in Q2 2024 likely stems from the enhanced detection capabilities of endpoint detection and response (EDR) technologies.

In this report, we explore the most active ransomware groups, the sectors they’re targeting, and geographic trends. This report will give you visibility into the ever-changing ransomware landscape and offer actionable strategies to boost your cybersecurity defenses.

Ransomware Activity in Q3 2024

As predicted in our Q2 2024 ransomware report, Q3 2024 saw a slight increase in ransomware activity, with 1,266 organizations listed on ransomware data-leak sites—a 2.3% increase from 1,237 in the previous quarter. This also marks a 21% jump from 1,041 in Q1 2024, which experienced the usual seasonal slowdown. However, compared to the same quarter last year, ransomware activity in Q3 2024 is down 1.5%. This likely results from the instability that has plagued the ransomware landscape: RaaS providers who are competing for affiliates are spending more time recruiting and less time developing their tactics, capabilities, and attack consistency. Other probable factors include law enforcement action in 2024 leading to the dismantling of key infrastructure, improved detection capabilities of security tools, and advancements in EDR technology and cybersecurity practices.

Figure 1: Number of compromised organizations listed on data-leak sites, Q4 2023–Q3 2024

In Q3 2024, new top contenders emerged, challenging LockBit’s dominance. Thanks to aggressive recruitment and sophisticated attack strategies, RansomHub has claimed the number one spot, becoming the most dominant ransomware group. Its activity surged from 21 posts in Q1 2024 to 195 posts in Q3 2024, representing an increase of over 800%. This significant spike is likely driven by its vigorous recruitment efforts in H1 2024. RansomHub posted ads on the dark web, offering a lucrative 90/10 profit-sharing split and targeting affiliates from disrupted groups like “ALPHV” and LockBit to bolster its ranks. RansomHub typically gains initial access into networks by exploiting internet-facing applications like virtual private networks (VPNs), abusing valid credentials, and conducting social engineering attacks.

Figure 2: RansomHub data-leak site

Meanwhile, the ransomware group Play has maintained consistency, securing the second spot for the second consecutive quarter. Both Play and RansomHub have capitalized on the disruption among larger, more established entities, filling the void left by their decreased activity. This shift underscores the dynamic nature of the ransomware landscape and the continuous evolution of the techniques used by threat actors. The competitive RaaS ecosystem drives these groups to continuously improve their tactics, techniques, and procedures (TTPs), focusing on sophisticated attack vectors, social engineering, and evasion methods. This relentless innovation makes threat actors more refined, targeted, and efficient, enabling them to have a bigger impact despite efforts to curb their activities.

To counter these methods, organizations should prioritize educating users on phishing and social engineering techniques. Employees must be aware of how attackers might manipulate them into revealing sensitive information or granting the attackers access to secure systems. However, given the increasing sophistication of these attack techniques, education alone isn’t always enough to prevent a cyber attack. That’s why a robust security operations program is crucial for protecting networks and sensitive data. Security practitioners should prioritize patching and correctly configuring VPNs, enforcing stringent Remote Desktop Protocol (RDP) policies, and monitoring credential sales on dark web marketplaces.

ReliaQuest’s GreyMatter Digital Risk Protection (DRP) is an effective security operations tool to help security teams mitigate data exposures, breaches, brand threats, and third-party risks through features like asset-based monitoring, extensive data source coverage, and credential leak detection. By implementing these measures, organizations can significantly bolster their defenses against the evolving tactics of ransomware groups.

Key Targeted Regions

Figure 3: Number of organizations listed on data-leak sites by geography, Q3 2024

As expected, the US accounted for approximately 50% of ransomware victims posted to data-leak sites, while English-speaking countries made up around 70% of posts. This trend continues quarter after quarter, likely because organizations in English-speaking countries are perceived to have the financial means to pay ransoms. English-speaking countries, particularly the US, UK, Canada, and Australia, have well-developed insurance markets and higher cybersecurity awareness, resulting in higher ransomware insurance adoption. Cyber insurance makes these regions more attractive targets, as attackers believe that insured organizations are more likely to pay to minimize operational impact.

Some groups, like “Akira” (see Figure 4), use stolen data to determine an organization’s cyber insurance payout limits, boosting the chances of ransom payment. Our analysis revealed that organizations mentioning cyber insurance during negotiations were more likely to pay ransoms closer to the initial demand compared to those that didn’t.

However, some cyber insurance policies explicitly forbid ransom payments. Paying a ransom in violation of these terms may void the policy or lead to denial of coverage. For a CISO, sticking to policy terms is crucial to maintain coverage and avoid financial burdens. Ensuring insurance coverage is vital for preserving stakeholder confidence and preventing reputational damage.

Figure 4: Ransomware negotiation (source: Ransomware[.]live)

High-Risk Sectors

Figure 5: Ransomware targets by sector, Q3 2024

The professional, scientific, and technical services (PSTS) sector experienced the most ransomware activity in Q3 2024. Cybercriminals target these PSTS companies due to their significant vulnerability to disruption, making them more likely to make a ransom payment. The PSTS sector is a lucrative target as organizations in the sector handle sensitive intellectual property, confidential client information, and critical research data. Its reliance on continuous access to digital resources for day-to-day operations amplifies the impact of ransomware attacks, compelling companies to pay ransoms to restore functionality.Top of FormBottom of Form

Other sectors, like manufacturing, construction, and health care and social assistance (HSA), also grapple with significant ransomware threats. Despite minor shifts in ranking from quarter to quarter, the top five targeted sectors in Q3 2024 remained consistent with previous trends. Cybercriminals focus on targeting the manufacturing and HSA sectors as these sectors are much more susceptible to operational disruptions, making ransom demands more effective. The integration of IT with operational technology (OT) in these sectors exacerbates the issue, as downtime leads to major productivity, financial, or legal consequences.

The Ransomware Groups to Watch

Despite a slowdown in activity, with fewer than half the number of posts compared to last quarter, LockBit remains a significant threat. Its network of loyal, long-term affiliates continues to pull off sophisticated and complex attacks, ensuring LockBit’s ongoing impact. The group’s resilience is evident in its swift recovery from the February 2024 Operation Cronos takedown and arrests, largely thanks to its decentralized business model. This involves recruiting independent affiliates who conduct attacks for a profit share. Affiliates are supported by comprehensive resources and continuous innovation, leveraging distributed operations, multiple infrastructure layers, geographic dispersion, and robust communication channels. This ensures resilience and adaptability against disruptions.

“Meow” ransomware ramped up its activity in Q3 2024, jumping from three or four data-leak posts per month in the first half of the year to ranking fourth in Q3 with 67 reported victims. Initially known for encrypting data, the group shifted tactics in Q3 2024, moving from directly extorting organizations to selling stolen data on cybercriminal forums like XSS and BreachForums, as well as on its own data-leak site, “Meow Leaks.” The group offers data at two price points: one for exclusive sale to a single buyer and another for multiple buyers.

Targeting organizations likely to possess sensitive data, Meow aims to attract buyers to its marketplace. The group obtains this data through phishing emails with malicious links and attachments, exploiting vulnerable software and using RDP to move laterally within environments. The leaked data ranges from patient medical records to bank account details and strategic business plans, leading to identity theft, financial fraud, and competitive disadvantages. As such, these breaches have severe repercussions for both individuals and organizations.

Figure 6: Top ransomware groups, Q3 2024

In Q3 2024, the top five most active ransomware groups accounted for only 40% of observed data listings, down from 61% in Q3 2022. This drop signals a shift from large ransomware syndicates to smaller, more fragmented groups performing targeted attacks. This fragmentation makes tracking and predicting TTPs more challenging, as smaller groups often operate under the radar, using less common and poorly documented tools and methods. Unlike larger, well-studied groups, these smaller threat groups can frequently change their tactics, complicating the establishment of consistent detection strategies. The lack of a centralized structure scatters intelligence, making it harder to collect, analyze, and act upon, leading to gaps in threat awareness and preparedness. Fragmentation has also resulted in increased competition and innovation, as noted by users on the Russian-language ransomware-focused forum RAMP. For instance, a forum member commented, “It’s good when the market isn’t a monopoly and there’s competition, it means there will be much better growth. You’re competition for me, but I’m happy to welcome you to the market with kind words” (translated from Russian, see Figure 7).

Figure 7: A user on RAMP expresses their support for market competition, noting that it fosters growth and innovation

RansomHub’s profit-sharing payment model, introduced in Q2 2024, highlights the growing competition. Affiliates receive 90% of ransom payments—significantly more than the 70-80% offered by other groups—while RansomHub takes the remaining 10% as a fee. This attractive profit split, along with the promise that RansomHub gets paid second, has boosted the group’s appeal among cybercriminals. The surge in affiliates has directly led to a spike in ransomware activity, with posts increasing from 21 in Q1 2024 to a staggering 195 in Q3 2024—a 159% increase.

Play has gained prominence by using specific initial access techniques to compromise networks. They abuse valid accounts and exploit known vulnerabilities in public-facing applications like FortiOS and Microsoft Exchange: Ransomware actors associated with Play are known to target external-facing services such as RDP and VPNs to gain initial access. Inspired by Play’s success, other ransomware groups are following in Play’s footsteps. As a result, organizations must be vigilant in patching known vulnerabilities and securing external-facing services to defend against these initial access methods.

Major Events in Q3 2024

Play Ransomware Targets ESXi Environments

Play, infamous for its double-extortion tactics, has rolled out a Linux variant of its ransomware targeting ESXi environments. This move broadens its attack surface across the Linux platform and almost certainly expands the group’s potential victim pool. VMware ESXi environments are widely used to run multiple virtual machines hosting critical applications and data. As a result, compromise could disrupt operations and encrypt backups and VM snapshots, severely hampering recovery efforts.

The Play variant checks if it’s on a VMware ESXi machine before executing, ensuring it only encrypts files in these critical environments. The ransomware then shuts down, encrypts all virtual machines, and places a ransom note on the server’s login page (see Figure 8). This makes essential applications and data inaccessible and effectively halts business operations, significantly impacting productivity and service delivery. Additionally, with Play’s double-extortion tactics, organizations risk data breaches and public exposure of sensitive information, leading to regulatory fines and reputational damage. Financial implications are substantial, whether paying the ransom or covering recovery costs, including IT forensics, system restoration, and legal fees. A successful attack would also erode customer trust and stakeholder confidence, further damaging the organization’s reputation and financial standing.

Figure 8: Play’s ransom note on a compromised ESXi server

To protect ESXi environments from ransomware attacks, organizations should keep their environments up to date and promptly patch vulnerabilities that ransomware groups could exploit. Regularly maintain secure backups of all critical data, storing them offline and testing them to ensure data can be recovered without paying a ransom. Implement network segmentation to segregate critical systems and limit threat actors’ access.

Beyond detection rules, GreyMatter accelerates the remediation process with Response Playbooks. To effectively combat Play ransomware, we recommend incorporating the following Response Playbooks into your incident response plan.

Isolate Host: After evaluating the potential impact on legitimate user activities and essential business processes, this Playbook will isolate the infected system by cutting off the attacker’s connections to the command-and-control (C2) infrastructure. This will prevent any further communication with the attacker, stopping them from executing additional commands or downloading more malicious files.

Disable User, Terminate Active Sessions, Reset Password: Once a compromised user account is identified, these Playbooks will disable the user account, terminate any sessions hijacked by the threat actor, and rotate the credentials of the affected user to prevent further compromise.

Adopting automated incident response provides organizations with the fastest and most effective remediation. We recommend enabling GreyMatter Automated Response Playbooks to detect, contain, and respond to threats automatically, improving mean time to contain (MTTC) and limiting potential damage. Alternatively, our analyst team can deploy Response Playbooks on your behalf, further speeding up the remediation process.

Major Fortinet Breach: 440GB Data Stolen

On September 12, 2024, news broke of a data breach at the cybersecurity solution company Fortinet. The breach was announced by user “Fortibitch” on the popular English-language cybercriminal forum BreachForums. Claiming to have stolen 440GB of data from Fortinet’s Azure SharePoint instance, Fortibitch, whose account was highly likely created solely for this announcement, tried to extort Fortinet by demanding a ransom to prevent the stolen data from being publicly released. Fortinet allegedly refused to pay. The threat actor then shared the credentials of an Amazon Web Services (AWS) S3 bucket where the data was stored, making the data accessible for browsing and download by other threat actors. Within 48 hours, the data was no longer accessible, although the reason behind the removal remains unclear.

Figure 9: BreachForums user “Fortibitch” advertising the stolen Fortinet data

Fortinet confirmed the breach, admitting that customer data had been stolen from a third-party cloud-based shared file drive. The company stated that unauthorized access was gained to a limited number of files containing data related to some Fortinet customers. While the exact number of impacted customers and the nature of the compromised data weren’t disclosed, Fortinet assured that they had directly communicated with those affected.

This attack supports our predictions from Q2 that threat actors would shift towards single extortion tactics. This Fortinet breach is reminiscent of the June 2024 cyberattack on Snowflake, the cloud-based data-warehousing platform. In both cases, sensitive data was stolen, and victims were extorted with threats that their stolen information would be publicly released.

Exfiltration-only ransomware can be just as damaging as encryption-based ransomware. Publishing stolen data can seriously damage a company’s reputation and erode customer trust, potentially leading to loss of business and legal repercussions. The exposure of sensitive information can also open the door to further cyber attacks, as other threat actors may exploit the leaked data for additional malicious activities such as brute-forcing or fraud.

Executing the following GreyMatter Response Playbooks can accelerate and automate your reaction to potential data exfiltration, allowing you to swiftly contain threats and mitigate potential damage to your security operations environment.

Block IP, Block Domain, and Block URL: Executing these Playbooks on identified attacker infrastructure or exfiltration endpoints will allow you to halt data exfiltration by severing network connections. We recommend automating the Block Domain Playbook, as we commonly see cloud storages services such as Mega.io being used for exfiltration.

Isolate Host: After assessing the impact on legitimate user activities and business-critical processes, this Playbook will contain the infected system by stopping C2 communication to prevent the attacker from exporting additional files

2024 Ransomware Forecast: What to Expect

Although Q3 2024 saw a minor uptick in ransomware activity, the growth rate remains lower than in previous years. We are highly confident that ransomware incidents will steadily increase over the next three months, peaking by the end of Q4 2024. This anticipated rise will likely be driven by the reorganization and aggressive recruitment efforts of groups like RansomHub and “Inc Ransom.”

How LLMs Are Shaping Ransomware Negotiations

In the long-term (beyond one year), it’s realistically possible that threat actors will increasingly use large language models (LLMs) in ransomware negotiations to overcome language barriers and expand their reach. LLMs enable non-English speakers to negotiate effectively and persuasively with targets worldwide, broadening their target pool. Business-minded RaaS platforms may capitalize on LLM capabilities, equipping affiliates with automated, professional negotiation tools. This would allow even novice cybercriminals to conduct sophisticated ransomware campaigns globally, likely boosting extortion success rates. As a result, businesses must stay vigilant, as they will face elevated operational and financial risks. This calls for stronger cybersecurity measures, comprehensive employee training, and investments in third-party incident response retainers or negotiators. By proactively addressing these evolving threats, businesses can ensure their networks remain secure and resilient.

Growing Threat: Exfiltration-Only Ransomware

We predict with high confidence that, in the mid-term future (three months to one year), the number of ransomware groups adopting exfiltration-only tactics will increase by at least 25%. This upward trend is already evident in groups like Inc Ransom, which have pivoted to focusing on stealing and extorting sensitive data. The shift from traditional encryption ransomware attacks is driven by the enhanced effectiveness of data backups and recovery solutions, as well as increasingly sophisticated EDR technologies that make encryption more challenging to execute undetected. By concentrating on data theft and threatening public release, ransomware groups exploit organizations’ fears of reputational damage, regulatory fines, and competitive disadvantage.

Splintering of LockBit Ransomware

In the short term (within three months), it is realistically possible that LockBit will restructure into one or more new groups, similar to “Conti.” This splintering could result from increased law enforcement pressure, the need for better operational security, and a desire to diversify tactics. Smaller, decentralized groups are more difficult for authorities to track and may also experiment with different ransomware strains and attack vectors, potentially adopting an affiliate model much like RansomHub’s to stay competitive. Law enforcement pressure forcing large groups to fragment is not a new trend. Major ransomware collectives like Conti and “Ryuk” have already broken up into smaller entities to evade detection and stay effective. Decentralization helps cybercriminals quickly adapt to evolving cybersecurity defenses and law enforcement tactics, making adversary groups more challenging to track and dismantle.

What ReliaQuest is Doing

ReliaQuest recently launched the first autonomous, self-learning AI agent for security operations in its GreyMatter platform. This cutting-edge tool enhances our ability to analyze and interpret complex threat patterns, automate threat detection, and streamline response actions, significantly reducing MTTC and bolstering overall cybersecurity defenses.

We also actively monitor the evolving ransomware landscape by profiling new groups, tracking their daily activities, and observing shifts in threat actor TTPs. Our Threat Research team continuously updates detection rules to help our customers stay ahead of emerging trends and enabling us to develop tailored detections that strengthen your defenses. By deploying these detections alongside Response Playbooks, you can significantly reduce your MTTC during ransomware incidents—from several hours to just a few minutes.

Recommendations and Best Practices

In addition to standard ransomware defense measures—such as maintaining rigorous backup policies, increasing endpoint visibility and detection, keeping all software up-to-date, monitoring external-facing assets, and using application controls—we recommend the following measures to best protect your environment from the threats highlighted in this report.

• Implement Digital Risk Protection Solutions: Use services such as ReliaQuest GreyMatter DRP to detect exposed credentials on cybercriminal forums and thwart initial access by ransomware groups.
• Block JavaScript Execution via wscript.exe: Simply and effectively stop Javascript-based malware (like SocGholish or GootLoader) from executing by setting .JS files to open with notepad.exe instead of wscript.exe, deterring user execution. These malware strains often precede ransomware attacks.
• Harden JML Policies: Implement strong joiners, movers, leavers (JML) policies to ensure that access rights are promptly updated or revoked when employees change roles or leave employment, minimizing the risk of attackers exploiting expired or overly privileged accounts
• Enhance Employee Training on Social Engineering: Train employees on common social engineering tactics. Organizations shouldn’t overlook the important of this, as in 2024, we identified at least two distinct social engineering campaigns from ransomware actors. One campaign targeted the health care sector with vishing (voice phishing) and social engineering to reset multifactor authentication (MFA) on user accounts, allowing threat actors to gain initial access. Another campaign, orchestrated by the group Black Basta, involved a mass email spam attack and vishing to deceive end users into granting the attackers network access, ultimately aiming to deploy ransomware.