Ransomware Trends in 2023: More Extortion, Data Theft and Group Turnover
Summary
DarkOwl’s 2023 roundup describes reported ransomware trends, including rising extortion and data theft, intermittent encryption, attacks on healthcare and defense, and groups returning after disruptions. Estimates and actor claims remain uncertain.
Key points
- The roundup says the U.S. accounted for 55% of reported ransomware incidents and November 2023 had 89 reported attacks; the figures may be incomplete.
- Observed trends included multiple ransomware variants used against one victim, more triple or quadruple extortion, and intermittent encryption alongside data exfiltration.
- LockBit and ALPHV/BlackCat were identified as the most active groups. Both returned after law-enforcement disruptions, according to the article.
- The article describes Cl0p’s exploitation of MOVEit’s CVE-2023-34362 and estimates that about 2,000 installations were affected, with roughly 60 million people impacted; it notes the totals remain uncertain.
- Healthcare was described as the most targeted sector. Examples included reported incidents affecting Prospect Medical Holdings, Henry Schein, and Ardent Health Services.
- DarkOwl reports that ransomware groups and affiliates increasingly reused or sold source code, while new forums and messaging platforms offered alternatives to leak sites and traditional forums.
- Several victim and payment claims remain attributed or uncertain, including LockBit’s unsubstantiated claim of access to Boeing and the reported $22 million payment by UnitedHealth’s Change Healthcare unit to ALPHV affiliates.
Article Details
- Publisher
- DarkOwl
- Report Period
- 2023 and early 2024
- Scope
- Ransomware trends, groups, incidents, and targeted sectors
- Key Statistics
- The United States accounted for 55% of ransomware incidents, according to publicly available industry and government metrics.
- November 2023 had 89 reported ransomware attacks, a record monthly count in the article's reporting.
- The MOVEit campaign was estimated to affect about 2,000 installations and approximately 60 million individuals; the article notes these figures remain uncertain.
- Experts estimated Cl0p could receive $100 million in payments from exploiting CVE-2023-34362.
- The article reports that traceable ransomware payments exceeded $1 billion for the first time.
- Recommendations
- Critical infrastructure, academic, technology, and government organizations should raise awareness and strengthen protection against ransomware campaigns.
- Use continuous monitoring to identify ransomware incidents earlier.
- Monitor leak sites for an organization's brand, employee names, intellectual property, and other sensitive material.
CVE
Threat Actors
ALPHVAlso referred to in the article as ALPHV/BlackCat; a highly active ransomware group that claimed responsibility for the MGM incident and was reported to have attacked Henry Schein.BlackCatAlso referred to in the article as ALPHV/BlackCat; a highly active ransomware group that claimed responsibility for the MGM incident and was reported to have attacked Henry Schein.Cl0pRansomware group reported to have exploited CVE-2023-34362 in a campaign targeting MOVEit users beginning in May 2023; also identified as TA505.LockBitRansomware group identified as the most active in 2023; the article reports it claimed to infiltrate Boeing and temporarily went offline in February 2024 before resuming operations.TA505The article identifies TA505 as another name for Cl0p, the ransomware group that exploited CVE-2023-34362 in the MOVEit campaign.
Malware
Black SuitRoyal Fall 2023 N Y Unconfirmed if code was sold, but the overlap between Royal and Black Suit is publicly documented Y, as “Black Suit”BlackByteBlackByte Dec 2023 BlackCatLockBit ransomware gang were the top actors of 2023, with BlackCat/ALPHV coming in second as most active.Cl0pOriginally observed in 2019, Cl0p ransomware gang began their use of the MOVEit vulnerability to target victims in May 2023, and continued this campaign all summer long.Hunters InternationalRansomware gang Hunters International group claimed responsibility for the incident.LockBitLockBit ransomware gang were the top actors of 2023, with BlackCat/ALPHV coming in second as most active.Ragnar LockerRagnar Locker Oct 2023 Y N N NRansomedVCRansomedVC Oct 2023 N Y Y Y, as “Raznatovic“RhysidaRhysida ransomware, a group that emerged in August 2023, targeted Prospect Medical Holdings (PMH) in early August 2023, and recently released the claim that they procured upwards of 500,000 corporate documents andRoyalRoyal Fall 2023 N Y Unconfirmed if code was sold, but the overlap between Royal and Black Suit is publicly documented Y, as “Black Suit”
Products
Tools
Countries
AustraliaAustralia-based Austal USA, a shipbuilding company, revealed it was the victim of a cyberattack as of December 6, 2023.ChinaBut the number of incidents is not the only significant increase – ransomware data exfiltration rates exploded, with notable data exfiltration to China.United StatesAccording to the cyber threat intelligence industry and government metrics made publicly available, the United States remained the top targeted nation, with 55% of ransomware incidents targeting the country.
Industries
Critical infrastructureRansomware actors are increasingly targeting Critical Infrastructure/Key Resources (CI/KR) blueprints and documents to move towards damaging physical structures and sectors needed for everyday life services, such asDefenseWhile healthcare was the most targeted sector, the defense industrial base was not far behind as a ransomware target.HealthcareThe healthcare sector was the most targeted sector of 2023.