Ransomware tracker: The latest figures [November 2023]

Note: this Ransomware Tracker is updated on the second Sunday of each month to stay current

Ransomware attacks across several key sectors dipped significantly in October, breaking a streak that has gone on for much of 2023.

Ransomware gangs posted 243 victims to their extortion sites in October — a sharp decrease from the 455 victims in September, and the lowest number since February.

Attacks on state and local governments, healthcare providers, and schools also dropped, though they generally remained higher than the number of victims recorded during the same period in 2022, according to data collected by Recorded Future from extortion sites, government agencies, news reports, hacking forums, and other sources.

Allan Liska, a Recorded Future ransomware expert who is involved with collecting and analyzing the attack data, pointed to three recent incidents that might explain the decline in attacks. In late August, the FBI and other law enforcement agencies dismantled the Qakbot ransomware gang's infrastructure and removed ransomware from infected devices.

Similarly, the Ragnar Locker ransomware site was taken down by law enforcement last month in an international action. Around the same time, Ukrainian hackers said they wiped the servers of the Trigona ransomware gang, which allegedly was tied to Russia.

"All of these groups will regroup and restart their services, but it creates a real disruption in the number of attacks that can be carried out," said Liska. "This is why continuous law enforcement is so important (and while I don’t endorse it, the occasional Ukrainian hacktivist activity is nice too), keeping ransomware groups off balance slows down attacks. But it only works if the takedowns happen all the time."

Graphs from this ongoing project can be shared and reproduced with proper attribution.

Adam Janofsky

Adam Janofsky is the founding editor-in-chief of The Record by Recorded Future. He previously was the cybersecurity and privacy reporter for Protocol, and prior to that covered cybersecurity, AI, and other emerging technology for The Wall Street Journal.