Ransomware Review: First Half of 2024

Unit 42's 1H2024 ransomware leak site analysis found 1,762 compromise announcements across 53 leak sites (an increase of 4.3% YoY), with six groups accounting for over half of compromises; manufacturing, healthcare and construction were the most impacted sectors and the U.S. accounted for 52% of victims. The report details active exploitation of multiple vulnerabilities (including CVE-2024-1708, CVE-2024-1709, CVE-2024-27198, CVE-2024-4577, CVE-2020-1472 and others), law enforcement takedowns and exits (e.g., ALPHV/BlackCat, LockBit disruptions), and the emergence of new ransomware operators and rebrands filling the void.