Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools

Ransomware activity increased in 2023 compared to 2022, according to Google-owned Mandiant.This is despite broadscale law enforcement operations against prominent ransomware groups, including ALPHV/BlackCat.

In 2023, Mandiant noted a rise in ransomware activity, reflected by more posts on data leak sites and a moderate increase in ransomware investigations. Around a third of new ransomware families were variants of existing ones. Attackers mainly used commercially available tools for ransomware deployment, with a decline in Cobalt Strike BEACON and a rise in legitimate remote access tools. Ransomware was deployed within 48 hours in about one-third of cases, and 76% of deployments occurred outside work hours, primarily in the early morning.