Category deep-dive: Ransomware demands reached an all-time high in 2024

Editor’s note: The following post is an excerpt from our 2025 Crypto Crime Report, which we are breaking down by threat category over the coming weeks. In previous posts, we took a look at overall crypto transaction volumes, how sanctioned entities drove illicit crypto volume in 2024, and trends in the use of crypto in terrorism financing over the past year. 

To read the 2025 Crypto Crime Report in full and download your copy, click here.

{{horizontal-line}}

Ransomware remained a prolific and growing threat in 2024, with 5,635 publicly reported attacks (analysis is based on ransomware leak site data available as of January 6, 2025; excludes underreported incidents) — surpassing 5,223 in 2023. 

The financial demands of ransomware actors have also reached unprecedented levels, exemplified by a record USD 75 million payment made to the Dark Angels ransomware group in March 2024. These escalating ransom demands highlight the increasing boldness and sophistication of threat actors, who are leveraging advanced tools and techniques to maximize their extortion efforts.

The landscape of ransomware and crypto-related crime is highly fluid, where today's standards are subject to rapid evolution. A notable trend identified by TRM’s threat intelligence team in 2024 was the decline in the use of cryptocurrency mixers for laundering ransomware proceeds. Instead, threat actors are increasingly leveraging cross-chain bridges to obfuscate transactions and enable seamless cryptocurrency conversions before cashing out.

Though bitcoin remains the primary currency for ransomware payments, a substantial portion of these funds is converted to other cryptocurrencies downstream. The use of bridges provide a quicker and more efficient means of converting illicit funds, while creating an illusion of greater anonymity for cybercriminals.

New ransomware groups entered the field, while other existing groups rebranded

2024 saw the emergence of several new ransomware groups, including Brain Cipher, dAn0n, DragonForce, Fog, Funksec, RansomHub, Sarcoma, and Trinity. These groups have quickly gained notoriety for their sophisticated tactics and successful attacks across various industries. For example, Trinity has been associated with targeting critical infrastructure such as healthcare and government organizations — including two healthcare providers based in the United Kingdom and United States.

In addition to new entrants, several prominent ransomware groups rebranded or shifted operations under new names to evade law enforcement scrutiny. Notable examples include the resurgence of groups like Lynx (aka INC), DennistheHitman (aka GlobeImposter), and Qilin (aka Agenda), which have adopted innovative extortion methods to enhance their effectiveness. 

The Ransomware-as-a-Service (RaaS) model continues to dominate the ecosystem, empowering less-skilled actors to carry out high-impact attacks. Affiliates have become increasingly adaptable, often switching between platforms and groups, as evidenced by on-chain activity. 

While the ransomware landscape has traditionally been strongly associated with Russian-speaking actors, especially at the administrator level, it has diversified over the years. Groups are now incorporating affiliates from geographies around the world with a wide spectrum of language skills. For instance, DragonForce ransomware demonstrates this shift, with ties to Northern or Central Asia, as suggested by audio recordings of its associated actors on their TOR site.

Despite this change, Russian-speaking ransomware groups remain very active — with some of the most sophisticated actors in the cybercriminal landscape. Many of these groups are linked to high-profile attacks, leveraging advanced encryption techniques, innovative extortion tactics, and RaaS models to scale operations.

Notable attacks in 2024 primarily targeted the technology, retail, and financial services sectors

Data leak sites have proliferated, serving as platforms for public shaming and extortion. These sites are increasingly used in multi-layered extortion strategies, adding pressure on victims to pay ransoms by posting victim names and company details.

Ransomware attacks in 2024 continued to target critical sectors, causing widespread disruption — with the top three sectors being technology, manufacturing, and professional services (analysis is based on ransomware leak site data available as of January 6, 2025; excludes underreported incidents). Trends leading into 2025 suggest ransomware groups will continue to target healthcare and critical infrastructure, supply chain vulnerabilities, and cloud service providers to maximize their efficiency and impact.

• Healthcare and critical infrastructure: Healthcare systems remain a prime target, with attacks causing significant disruptions to patient care and operations. Attacks against organizations like Change Healthcare and PIH Health underscore the vulnerability of critical services to cyber threats.

• Supply chain compromises: Attackers have increasingly focused on vendors and service providers like CDK Global and Blue Yonder to maximize downstream impacts. This tactic has been particularly disruptive in the technology and manufacturing sectors, where dependencies are high.

• Cloud service providers: High-profile attacks have targeted cloud service providers, resulting in the exposure of sensitive data and global service disruptions. In June 2024, data theft attacks targeted customers of the cloud data platform Snowflake, leading to breaches at companies like AT&T, Ticketmaster, and Santander Bank. Attackers obtained login credentials through infostealer malware, compromising sensitive customer data.

International collaboration is critical in disrupting ransomware actors

In 2024, global efforts to combat ransomware included major international collaborations like Operation Cronos, which disrupted LockBit's infrastructure, and Operation Endgame, targeting ransomware networks across Europe. The Counter Ransomware Initiative (CRI) gathered 68 nations to enhance strategies against ransomware, while sanctions targeted key figures in groups like Evil Corp. Increased collaboration between public and private entities has been instrumental in these successes. Real-time intelligence-sharing and joint operations have expanded resources and allowed for the timely disruption of ongoing attacks, highlighting the importance of strong partnerships in combating ransomware.

{{horizontal-line}}

Next up in this series: We take a closer look at crypto losses from hacks and exploits in 2024 — and detail key attacks carried out by North Korea last year.

Ready to dive into the full 2025 Crypto Crime Report? Get your copy here.