a backdrop image of text "2023 State of Ransomeware

The 2023 State of Ransomware report reveals that global ransomware attacks have reached an all-time high and have shown no signs of slowing down anytime soon. Within one year (July 2022 – June 2023), there has been a total of 1,900 ransomware attacks within just four countries – the US, Germany, France, and the UK.

The United States has been on the receiving end of 43% of all global attacks within the previous year, and attacks in France have nearly doubled in the last five months. To say ransomware gangs have been unkind to the US in the past year is an understatement. Within the 12-month observed period, the US has been attacked by a total of 48 separate ransomware gangs.

Image of a graph "known attacks in the ten most attack countries July 2022 - June 2023". Us - 1462 UK - 196 Canada - 159 Germany - 124 Italy - 120 France - 118 Spain - 90 Brazil - 77 Australia - 74 India - 63

The UK has emerged as the second-largest target with almost 200 ransomware attacks. Neither France nor Germany has been spared by the growing menace of ransomware, either. Germany has retained its place as the fourth most attacked country, and the most attacked country outside of the anglosphere. France has experienced an abnormally high rate of attacks on its government sectors.

An Emerging Threat

For more than a year, LockBit has been the most dominant ransomware gang in the US, with an average of 24 attacks per month.

However, twice this year, Lockbit’s rate of attack was exceeded by CL0P, an emerging “Ransomeware-as-a-Service” (RaaS) gang. CL0P has used multiple zero-days (such as GoAnywhere MFT and MOVEit Transfer) to gain an edge, which has given them the ability to launch an unprecedented number of attacks within a short time frame and across a massive scale.

Image of a graph "Comparison of monthly attacks by Lockbit and CL0P". In March 2023 CL0P had almost 50 to Lockbit's 25 attacks, and in June 2023, CL0P had more than 60 attacks compared to Lockbit's 25 attacks.

If more groups start adopting CL0P’s zero-day exploitation techniques, the ransomware landscape could tilt from service-oriented attacks to a more aggressive, vulnerability-focused model—a move that could skyrocket the number of victims.

Source:

Malwarebytes