Ransomware Q4 Overview

Q4 2021 saw an active and evolving ransomware landscape: 781 victims were named on ransomware data-leak sites, LockBit 2.0 was the most prolific group, and actors increasingly exploited newly disclosed vulnerabilities (Log4Shell, Confluence CVE-2021-26084, ProxyShell) and shifted tactics (single-extortion, faster intrusions). The RAMP forum accelerated group collaboration and advertising of affiliate programs, attacks concentrated against industrial goods and U.S. targets, and the report warns of continued growth and professionalization of ransomware operations into Q1 2022.