Anstieg der Ransomware-Aktivität: Neue Gruppen treiben Bedrohungslage an

Ransomware activity has surged in 2023 despite law enforcement efforts to combat prominent ransomware groups. Mandiant, a threat intelligence firm owned by Google, reported a 75% increase in posts on ransomware groups‘ data leak sites compared to the previous year. This escalation in ransomware incidents occurred across more than 110 countries, indicating the global reach and impact of these cyber threats.

In line with Mandiant’s findings, Chainalysis also revealed a disturbing trend, stating that over $1 billion was paid to ransomware attackers in 2023, marking a record high. The researchers at Mandiant attribute this resurgence in extortion activity to various factors, including the emergence of new ransomware groups, partnerships between existing groups, and the provision of ransomware services by actors previously associated with disrupted groups.

While established ransomware families like ALPHV/BlackCat and LockBit continued to dominate in 2023, Mandiant identified a significant increase in ransomware variants, with approximately 50 new variants introduced. Interestingly, around one-third of these new families were variants of previously identified ransomware families, hinting at threat actors‘ preference for updating existing ransomware rather than creating new ones from scratch.

Moreover, the reliance on remote management tools in ransomware operations saw a substantial uptick, with these tools being used in 41% of intrusions in 2023, up from 23% in 2022. This shift highlights the evolving tactics employed by threat actors to facilitate their malicious activities and underscores the persistent challenges posed by ransomware attacks despite law enforcement crackdowns on prominent groups.