Ransomware Families: 2021 Data to Supplement the Unit 42 Ransomware Threat Report
Summary: Unit 42 detected 113 different ransomware families in the wild in Q1 2021, with the top 15 families covering only 52.3% of total ransomware cases. When counting only cases infecting more than five hosts, the top three families were Ryuk (31.7%), Sodinokibi (20%) and Maze (15%), and email remained the most common delivery method.
What's compelling: The top 15 families account for just over half of cases, so static profiling cannot expand detection coverage to the rest - and Ryuk alone, which scans local networks and spreads over SMB and Wake-on-LAN, drove nearly a third of the multi-host infections Unit 42 observed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026