Sekoia mid-2023 ransomware threat landscape

The report provides an overview of a marked increase in ransomware activity in H1 2023, driven by mass adoption of double-extortion, Big Game Hunting, RaaS expansion and automated exploitation of vulnerabilities; it catalogues prominent new and rebranded groups (e.g., Cactus, 8base, Akira), evolving TTPs (malvertising, BYOVD, mass vulnerability exploitation), broader victimology, growth of custom exfiltration tooling, and the shift toward data-theft-first extortion models.