Newsletters
Risk Central
Digital EditionRansomware Attacks Hit Record High Despite Payment Decline: Travelers
Ransomware attacks hit an all-time high in Q4 2024 with 1,663 victims, yet total payments to attackers dropped 35% year-over-year to $813 million, signaling a shift in both attack methods and organizational responses to threats, according to Travelers’ Q4 2024 Cyber Threat Report.
In addition to an active fourth quarter, the ransomware landscape reached unprecedented heights in total in 2024, with threat intelligence research documenting a total of 5,243 victims posted on leak sites—marking a 15% increase from the 4,548 incidents recorded in 2023, according to the report. The global impact of these attacks resulted in the exposure of over 195 million records.
Despite the increasing frequency of attacks, financial metrics tell a different story. Total payments to ransomware groups reached $813 million for the year—a substantial sum, but one that actually represents a 35% decrease in revenue for ransomware operators compared to the previous year, according to the report. This divergence between rising attack numbers and falling ransom payments suggests organizations are increasingly refusing to pay attackers.
Shift in Attack Methodology
One notable evolution in ransomware tactics has been the move away from reliance on zero-day vulnerability exploitation, Travelers noted. Unlike previous peak periods of ransomware activity that were driven by opportunistic exploits of newly discovered vulnerabilities in common networking and software products, 2024 saw threat actors adopting more methodical approaches.
The new ransomware playbook focuses on reliable, repeatable methods to gain network access, particularly targeting weak credentials on VPN and gateway accounts that lack multi-factor authentication protection, according to the report. This shift can be traced back to the summer of 2023, when a ransomware training manual written by an “initial access broker” was leaked.
Rather than emphasizing the discovery of zero-day vulnerabilities, the manual advocated targeting widely-used VPNs with weak credentials, instructing attackers to look for default usernames like “admin” or “test” and to try combinations of common passwords, according to Travelers.
This methodology spread rapidly among initial access brokers and ransomware operators throughout 2024, enabling them to proactively hunt for profitable targets at scale. The days of threat actors waiting opportunistically for others to discover vulnerabilities have given way to a more systematic approach to victim selection, Travelers noted.
Impact on Organizations
While the financial toll of ransomware payments may be declining, the broader organizational impact remains severe. A review of 2024 claims received by Travelers revealed that attackers stole data in 87.6% of cases, a rate similar to 2023. This persistent threat of data theft creates significant exposure beyond the immediate ransom demand.
Even as organizations increasingly refuse to pay ransoms, they continue to face substantial costs from business disruption, IT system restoration, litigation, and regulatory fines for exposed records.
The Changing Landscape of Threat Actors
The ransomware ecosystem experienced substantial growth in 2024, with 55 new ransomware groups emerging on the scene. This represents a 67% increase in group formation compared to the previous year.
Government-backed threat actors are increasingly blurring the lines between state-sponsored cyber operations and criminal ransomware activities. Security researchers have uncovered troubling connections between nation-state actors and ransomware groups, the report found.
These nation-state connections bring enhanced resources and sophistication to ransomware operations. Government-backed groups are particularly advanced in leveraging artificial intelligence for various attack phases, including reconnaissance, research, and developing convincing phishing campaigns—capabilities that are gradually filtering down to their criminal partners, according to Travelers.
Notable Group Activities
The ransomware landscape of 2024 would be unrecognizable to observers from just a year earlier. RansomHub emerged as the dominant threat actor in Q4, responsible for 238 attacks—representing over 14% of the quarter’s total activity. Established groups like Akira and PLAY maintained significant operations with 133 and 95 attacks, respectively.
FunkSec represents one of the more intriguing developments in recent months, according to Travelers. This new group has drawn attention not just for its aggressive posture but for its unusual approach: Security researchers have questioned FunkSec’s technical capabilities, noting their heavy reliance on AI tools for code development.
Industry Impact and Targeting Patterns
The ransomware landscape of 2024 revealed clear patterns in which industries faced the most significant threats. IT services and consulting firms experienced a marked increase in targeting throughout the year, becoming prime targets for sophisticated threat actors.
The construction sector proved particularly vulnerable, suffering 129 attacks in the fourth quarter alone, representing a substantial 56% year-over-year increase, the report found. Health care organizations continued to face relentless pressure from ransomware operators, with attacks rising from 166 in 2023 to 210 in 2024.
Find the full report on the Travelers website. &
