Ransomware tracker: The latest figures [February 2024]
Note: this Ransomware Tracker is updated on the second Sunday of each month to stay current
Ransomware gangs started 2024 off at a slow pace, with attacks across several key sectors dipping in January.
Ransomware gangs posted 242 victims to their extortion sites in January — down from the 356 victims in the previous month, and the lowest number since February 2023.
Attacks on healthcare providers, state and local governments, and schools also decreased in January, with all three seeing the lowest number of monthly attacks since at least February 2023, according to data collected by Recorded Future from extortion sites, government agencies, news reports, hacking forums, and other sources.
"I think it is worth pointing out that despite the numbers being down overall the numbers for most of the countries we track individually were actually flat or up," said Allan Liska, a Recorded Future ransomware expert who helps track and analyze the data. "Ransomware groups may be focusing on 'where the money is.'"
Recent law enforcement actions against ransomware actors and individual cybercriminals could have temporarily contributed to a lull in attacks. In late August, for example, the FBI dismantled the Qakbot ransomware gang's infrastructure and removed ransomware from infected devices.
Similarly, the Ragnar Locker ransomware site was taken down by law enforcement towards the end of 2023 in an international action. Around the same time, Ukrainian hackers said they wiped the servers of the Trigona ransomware gang, which allegedly was tied to Russia.
But past takedown efforts have only given victims temporary relief — ransomware groups generally regroup and rebrand themselves after attracting attention from law enforcement.
"The broader point remains: a month does not necessarily indicate a trend," Liska said.
Graphs from this ongoing project can be shared and reproduced with proper attribution.
is the founding editor-in-chief of The Record from Recorded Future News. He previously was the cybersecurity and privacy reporter for Protocol, and prior to that covered cybersecurity, AI, and other emerging technology for The Wall Street Journal.