Ransomware Retrospective 2024: Unit 42 Leak Site Analysis
Summary: Unit 42's analysis of ransomware leak site data found 3,998 posts in 2023, up from 2,679 in 2022, a roughly 49% increase, with at least 25 new ransomware groups appearing and manufacturing the most affected industry. Zero-day exploits such as CVE-2023-0669 in GoAnywhere MFT and the MOVEit Transfer SQL injection flaws drove spikes in activity by CL0P, LockBit and ALPHV (BlackCat), while law enforcement actions led to the decline of Hive and Ragnar Locker and the near-collapse of ALPHV.
Why it matters: 47% of 2023 leak site posts named U.S.-based victims, and CISA estimated CL0P's MOVEit exploitation alone compromised more than 3,000 U.S. organizations and roughly 8,000 victims globally - a scale that shows how fast one unpatched internet-facing file transfer service becomes a sector-wide event.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·