- FinCEN reports ransomware activity decreased in 2024 after removal of ALPHV and LockBit
- 2023 was the peak year with $1.1 billion in payments; In 2024, 1,476 incidents occurred and 734 million dollars were paid
- The collapsed gangs (ALPHV, LockBit, Black Basta) earned $790 million; Akira remains the most active, focusing on finance, manufacturing and healthcare.
The removal of the ALPHV and LockBit ransomware gangs had a significant impact on the overall performance of ransomware operations last year.
This is according to the Treasury Department’s Financial Crimes Enforcement Network (FinCEN), which recently said that after all-time highs in 2023, the number of ransomware infections and ransoms paid decreased in 2024.
In his article “Financial Trend Analysis,” he confirmed that between 2013 and 2021, 3,075 cases of ransomware infections were reported, and victims paid $2.4 billion in ransom demands.
Three key players out of the picture
Between January 2021 and December 2024, there were 4,194 such attacks and $2.1 billion in payments. 2023 was the peak year. That year, about $1.1 billion changed hands, which was a 77% increase compared to the previous year. Some of the most active groups at the time were ALPHV (AKA BlackCat), Akira, LockBit, Black Basta, and Phobos.
That’s when the authorities intervened. Both ALPHV and LockBit were eliminated, while Black Basta imploded after internal communications were leaked. As a result, there were “only” 1,476 incidents in 2024 (up from 1,512 the previous year) and about $734 million in payments.
The average payment for ransomware in 2023 was $174,000, significantly more than $124,097 in 2022 and $155,257 in 2024.
The three groups that collapsed, ALPHV, LockBit and Black Basta, raised almost $790 million between them during the period analyzed. Akira, which is active today, was responsible for the highest number of attacks (376), while ALPHV and LockBit had around 353 each. Financial services companies, manufacturing companies and the healthcare industry were the most attacked sectors.
Almost all payments (97%) were made in Bitcoin, which the gangs sent to unregulated cryptocurrency exchanges and mixing/tumbling services for laundering.
Through The record
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp also.
