Ransomware and Cyber Extortion in Q1 2024

ReliaQuest’s Q1 2024 ransomware report finds an 18% quarter-over-quarter dip in organizations listed on ransomware data-leak sites but a year-over-year increase, highlights active groups (LockBit, Black Basta, Play, ALPHV) and major events including a law enforcement operation against LockBit (Operation Chronos) and an ALPHV exit scam tied to a $22M ransom, identifies the US and manufacturing as top targets and common initial-access TTPs (phishing, exposed remote services, public-facing exploits), and forecasts renewed campaigns (Clop), greater cloud/SaaS targeting and AI-driven tactics while offering defensive recommendations (MFA, least privilege, backups, patching).