Nearly 40% of 2024 Ransomware Payouts May Have Gone to Russia, China & North Korea

Heimdal analyzes 2024 ransomware economics, estimating that of the $813M in victim payments (per Chainalysis), roughly 38–40% likely flowed to entities linked to Russia, China, and North Korea through shell companies and permissive infrastructure. The analysis highlights weak KYC, fragmented jurisdictions, and opaque ownership as key enablers, and recommends stronger registry verification, provider data sharing, payment transparency, public‑private intelligence collaboration, and enterprise defenses (segmentation, least privilege, immutable backups) to raise attacker costs and reduce profitability.