Huge drop in ransomware payments in 2024

Last year, threat actors only received approximately $813.55 million in payments from ransomware victims, which is a decrease of 35% compared to 2023’s record-setting year of $1.25 billion.

According to Chainalysis’ latest Crypto Crime Report, hackers collected around $459.8 million in ransomware payments between January and June 2024, which was 2.38% higher compared to the same time period in 2023. Therefore, cybersecurity experts expected last year to break 2023’s all time record.

Fortunately, things went down differently. In the second half of 2024, there were indeed more victims, but less of them decided to pay ransom demands. Also, the total amount of money that was paid dwindled.

The New York-based cybersecurity firm found that Akira, which has targeted more than 250 businesses and organizations since March 2023, was the only ransomware operation that ramped up its efforts in the second half of 2024.

The LockBit operation was disrupted by the United Kingdom’s National Crime Agency (NCA) and FBI. Therefore, they saw ransom payments decrease by 79%. ALPHV/BlackCat’s exit scam in January 2024 left a void in the second half of the year, which led to less ransomware victims.

“The market never returned to the previous status quo following the collapse of LockBit and BlackCat/ALPHV. We saw a rise in lone actors, but we did not see any group(s) swiftly absorb their market share, as we had seen happen after prior high profile takedowns and closures,” Lizzie Cookson, Senior Director of Incident Response at Coveware, said in a response.

“The current ransomware ecosystem is infused with a lot of newcomers who tend to focus efforts on the small- to mid-size markets, which in turn are associated with more modest ransom demands,” she continues.

Chainalysis concludes that international law enforcement operations, improved victim resilience, and emerging attack trends have shifted the willingness for victims to pay ransom demands.

“Crackdowns and collaboration with incident response firms and blockchain experts helped disrupt many ransomware groups, reducing their profitability. Victims also demonstrated greater resistance to ransom demands, widening the gap between demands and payments. Financial strategies continue to adapt under law enforcement pressure, although malicious actors face increasing difficulties laundering payments from victims,” the cybersecurity firm states.

To keep up the progress that was made in 2024, law enforcement agencies will have to continue their collaboration. In addition, businesses and organizations will have to invest in innovative defenses.