Lockbit Wanes, Ransomhub Rises: 2025 Extortion Leader?

According to analysts at Cybernews, using the Ransomlooker tool, certain areas of cybercrime in 2024 have been identified. Despite the efforts of law enforcement agencies, the number of attacks using ransomware continues to increase. Ransomlooker recorded 5300 victims of such attacks, which is a 26% increase compared to the previous year. For more information, visit Cybernews.

Lockbit maintained its position as the top group, despite facing challenges from the Cronos operation. However, the number of businesses affected by Lockbit decreased by 50%, highlighting a significant decline amidst the overall rise in attacks.

In the coming year, it is likely that Lockbit will be surpassed by Ransomhub, a rapidly emerging group in 2024. Ransomhub targeted around 500 organizations and demonstrated high adaptability in its attacks.

Play continues to hold the third position, focusing on targeted attacks in production, real estate, and technology sectors. Lockbit primarily targeted industrial enterprises, technological companies, and retail, while Ransomhub focused on construction, production, and trade.

An alarming trend in 2024 was the increase in the number of cybercrime groups to 89, up from 67 the previous year. Among these, 43 are newly formed or rebranded groups, indicating the dynamic and decentralized nature of the criminal ecosystem. New groups like KillSec and Funksec were able to impact 136 and 91 companies respectively, showcasing the low entry barrier to this criminal business.

Ransomlooker analysis also revealed seasonal patterns in hacker activity. The busiest periods were in spring and autumn, with up to 1,600 attacks per month, while summer saw a significant decrease in attacks. This may be attributed to some cybercriminals being on vacation during the summer months. To learn more, visit PT Security.

The sectors most vulnerable to attacks remained unchanged in 2024. Industrial enterprises were the primary target, with over 300 companies hacked, followed by the technology sector with 150 targeted companies. Real estate companies ranked third due to the value of their data and interconnected systems, making them attractive targets for extortionists.

Notable organizations affected in 2024 included giants like Volkswagen Group (with a $

/Reports, release notes, official announcements.