Ransomware Threat Intelligence Report: Q4 2024

Threat Landscape Overview

Ransomware remained the dominant cyber threat in Q4 2024, with a 34% increase in reported incidents compared to Q4 2023. Double-extortion tactics — encrypting data while simultaneously exfiltrating it for threatened publication — are now standard practice among major ransomware groups.

Active Threat Groups

LockBit 3.0 continued operations despite law enforcement disruptions, accounting for approximately 22% of ransomware incidents in Q4. BlackCat/ALPHV ceased operations following an exit scam, with affiliates migrating to RansomHub and Play ransomware. New groups including Hunters International and Meow emerged with significant victim counts.

Initial Access Methods

Phishing with malicious attachments or links (39%) and exploitation of public-facing vulnerabilities (31%) remained the primary initial access vectors. Valid credential abuse through compromised accounts from data brokers or prior breaches accounted for 22% of initial access. VPN vulnerabilities — particularly unpatched Cisco ASA and Fortinet appliances — were heavily exploited.

Victim Profiles

Healthcare (18%), manufacturing (16%), and financial services (14%) were the most targeted sectors by incident count. Mid-market organizations ($50M-$500M revenue) represented 47% of victims — large enough to have valuable data but often lacking mature security programs.

Ransom Economics

Median ransom demand increased to $4.2M in Q4 2024. Median payment when paid decreased to $1.5M, reflecting improved negotiation and insurance limitations. 34% of organizations that paid received a working decryptor; 29% experienced follow-on extortion attempts.

Defensive Recommendations

Priority controls: (1) Offline, immutable backups tested quarterly, (2) network segmentation to limit lateral movement, (3) EDR with 24/7 monitoring, (4) MFA on all remote access points, (5) privileged access management to limit blast radius, (6) patch management with SLA under 72 hours for critical vulnerabilities.