With ransomware whales becoming so dominant, would-be challengers ask 'what's the point?'

Rapid7's 2023–Feb 2024 analysis finds fewer new ransomware families but continued large-scale ransomware activity (~5,600 incidents), with LockBit and ALPHV/BlackCat among the most prolific operators; attackers increasingly exfiltrate data before encryption, rely on exploited public-facing applications and compromised accounts for initial access, and have escalated use of zero-day exploits—especially against network and security appliances—making enforced MFA and rapid patching critical defenses.