2023 Ransomware Attacks: First-Quarter Highlights

ReliaQuest’s Q1 2023 ransomware report details a surge in double-extortion ransomware activity, noting ~850 organizations named on data-leak sites and a record month in March; key events include Clop’s large-scale exploitation of a GoAnywhere zero-day (CVE-2023-0669) to exfiltrate data from 130+ organizations, the FBI’s disruption and server seizures targeting Hive, LockBit’s continued dominance, shifts in extortion-only activity, and changes in victimology by country and sector, plus mitigation recommendations.