Consumer Sector Becomes Top Ransomware Target

Despite significant efforts in cybersecurity, ransomware remains a virulent threat. The latest Cyber Threat Intelligence review from NCC Group recorded 1,252 ransomware attacks during the third quarter of 2024. While the data represents a 4% dip from the previous quarter, the data shows that ransomware continues to pose a critical challenge that demands constant attention and extensive resources.

The patterns and players in ransomware attacks are all too familiar. While there is always some fluctuation—government pressure pushes some criminal groups out, new players emerge, and older threat actors rebrand—the core threat persists. Between July and September 2024, Ransomhub, a group now under scrutiny from various regulatory and law enforcement agencies, stood out as the most active, responsible for 15% of ransomware attacks.

In a related note, the NCC Group report highlights the Cicada3301 ransomware, a malware strain that targets Linux and ESXi systems. Evidence suggests that Cicada3301 may be a rebranding of the long-standing BlackCat ransomware. The report also includes a threat-hunt section that explores the evolution of Quad7 botnets.

Ransomware groups appear to be broadening their range of preferred targets. While government agencies, financial services, healthcare, and other regulated industries have long been prime victims, the third quarter saw a shift. The consumer discretionary sector jumped to the top, accounting for nearly a quarter (24%) of all ransomware attacks during this period.

Related:Cybersecurity Developments & Priorities: November 2024

The report was developed by threat intelligence professionals who monitor ransomware data from various sources, including cybercriminal leak sites, information stolen in recent ransomware attacks, and NCC Group’s internal research and analysis. Covering ransomware activity from July to September, it provides a breakdown by region, sector, month, and threat actor and analyzes key events.