In 2024, the total amount of payments to extortionists decreased by 35% compared to the previous year, amounting to $ 813.55 million against $ 1.25 billion in 2023, as reported by CHAINALYSIS. Only about 30% of the victims who engaged in negotiations with cybercriminals ultimately agreed to pay the ransom.
Despite the decrease in total payments, 2024 saw an anti-record number of successful attacks – 5263 cases, the highest in the history of observations according to the NCC Group. One notable payment was $ 75 million transferred by Dark Angels from a company listed in the Fortune 50. However, there has been an overall decrease in the number of payments, indicating a growing resistance among victims of blackmail.
The decline in payments can be attributed to several factors. Companies are now better prepared for cyber attacks, implementing effective backup systems and bolstering protection to minimize potential losses. Additionally, trust in extortionists’ promises to delete stolen data has waned, and legal pressures have compelled companies to refrain from negotiations. More organizations are opting to restore systems independently to mitigate damage from reputational risks.
Law enforcement operations targeting cyber groups have also played a role. A significant event was the Kronos operation against Lockbit, one of the largest groups. Simultaneously, the ALPHV/Blackcat group shifted focus to alleged “exit fraud.” This upheaval created a void that less organized groups struggled to fill, despite the efforts of Ransomhub.
Although the average payment amounts have decreased, signaling tighter negotiations from victims, criminals are encountering challenges not only in receiving payments but also in laundering them. Heightened scrutiny of cryptocurrency exchanges and the closure of mixing services have forced attackers to seek alternative methods to legitimize funds.
In 2024, 39% of all ransom payments flowed through centralized exchanges, but an increasing number of criminals are storing funds in personal wallets to evade detection and potential arrest.
These trends indicate that cybercriminals are adapting to changing circumstances, yet state and business pressures continue to pose obstacles. Despite adaptations, the frequency of cyberattacks remains high, underlining the ongoing need to bolster protection mechanisms.