Last Week in Ransomware: 05.20.2024

This report summarizes recent ransomware developments: the U.K. NCA identified Dmitry Khoroshev as a LockBit administrator, FBI and CISA issued an updated alert on Black Basta’s widespread double‑extortion activity, and ransomware operators have escalated coercion by targeting executives' children using tactics like SIM swapping and caller ID spoofing; the briefing highlights exploited vulnerabilities (e.g., Citrix Bleed, PrintNightmare), malware (Qakbot), significant victims, and the persistent, evolving threat posed by RaaS operations.