Global Ransomware Attacks Reach Record High for 2023, According to Corvus Insurance Q4 Ransomware Report
BOSTON–(BUSINESS WIRE)–Jan 30, 2024
The year 2023 witnessed a staggering increase in ransomware attacks, as revealed by the Q4 2023 Ransomware Report released today by Corvus Insurance, the leading cyber underwriter powered by AI-driven cyber risk technology. The report, which collected data from ransomware leak sites, highlights that although Q4 attacks slightly decreased from Q3 2023, the overall ransomware activity for the year exceeded the totals of 2022 by a significant 68 percent.
Corvus Insurance closely monitored the ransomware landscape throughout 2023 and identified an alarming trend of attacks occurring at an unprecedented pace. The year started with a surge in ransomware attacks during the first three quarters, followed by a slight decline in Q4. The positive news in Q4 was partially due to notable international law enforcement interventions that disrupted the ransomware ecosystem. This included the takedown of ALPHV/BlackCat, one of the most prolific ransomware gangs, and the elimination of Qakbot, a prevalent malware used to infiltrate victims’ networks.
Though Q4 attacks dropped by 7 percent compared to Q3, with 1,278 victims identified on ransomware leak sites, the overall activity for Q4 2023 still rose compared to the previous year. Furthermore, 2023 set a new record for ransomware attacks, with a total of 4,496 victims reported on leak sites. This represents a significant increase from 2,670 victims in 2022 and 3,048 victims in 2021.
While ransomware activity reached an all-time peak in 2023, the real narrative lies in the remarkable impact of law enforcement on these groups as we ended the year, said Jason Rebholz, CISO of Corvus Insurance. Unfortunately, there is no time for celebration. Threat actors are resilient and have swiftly shifted to new malware, requiring everyone to maintain vigilance in mitigating these threats.
The Q4 Ransomware Report identifies several factors that influenced ransomware numbers over the quarter. Resilient threat actors pivoted to new malware strains after the disruption caused by the takedown of Qakbot. Malware strains like Pikabot and DarkGate were deployed to gain initial access to victim networks.
Additionally, the number of active ransomware groups increased by 34 percent from Q1 to Q4 2023. This rise can be attributed to the fragmentation of established ransomware groups, which publicly leaked their proprietary encryptors on the dark web. These leaked encryptors became accessible to new actors who initiated their own ransomware operations. Furthermore, disintegrated members of larger defunct groups formed splinter groups, resulting in an increased number of ransomware gangs conducting attacks.
While 2023 will be remembered for its surge in ransomware attacks, it is equally significant to acknowledge the resiliency of threat actors who quickly adapted by using new forms of malware to gain initial access, Rebholz emphasized. Throughout 2024, we anticipate observing similar patterns, as criminals persist in attacking, shifting tactics, re-branding, and striking again. Businesses should remain prepared with enhanced security controls and cyber insurance policies to minimize risk.
The Q4 Ransomware Report also highlights key industry trends. In the legal sector, the ALPHV/BlackCat ransomware group accounted for nearly a quarter of all victims in Q3, but the number decreased by 8.8 percent in Q4 due to law enforcement intervention. The transportation, logistics, and storage industry experienced consistent increases in ransomware attacks throughout 2023, with Lockbit 3.0 representing 22 percent of victims and ALPHV/BlackCat accounting for 15.87 percent. Given the potential for business interruption and the industry’s susceptibility, threat actors view this sector as an attractive target to exert pressure on victims for decryption payments.
For the full Corvus Q4 Ransomware Report, click here. To learn more about cyber threats in 2024, join the deep-dive webinar, Cyber Threats in 2024: What Claims Data Tells Us About the Dark Web, featuring Corvus experts.
About Corvus Insurance
Corvus Insurance is committed to building a safer world through insurance products and digital tools that reduce risk, enhance transparency, and improve resilience for policyholders and program partners. Their market-leading specialty insurance products, including Smart Cyber Insurance® and Smart Tech E+O™, leverage advanced data science capabilities. Corvus Insurance provides efficient quoting and binding through digital platforms and tools, along with proactive risk mitigation. Operating in the U.S., Middle East, Europe, Canada, and Australia, Corvus Insurance comprises Corvus Insurance Agency, LLC; Corvus Agency Limited; and Corvus Underwriting GmbH. All entities are subsidiaries of Corvus Insurance Holdings, Inc. Established in 2017, Corvus Insurance, a wholly owned subsidiary of The Travelers Companies, Inc., is headquartered in Boston, Massachusetts, with offices across the U.S., UK, and Germany. For more information, visit corvusinsurance.com.
Contact:
Kerry Pillion
kpillion@corvusinsurance.com
