In this report, we explore the big names in ransomware, the most frequently targeted sectors, trends in data exfiltration, and which malware and tools are leveraged by ransomware operators. This data creates insights into how organizations can better protect their environments from cyberattacks. The 2023 threat landscape was characterized by a combination of mainstay threat actors and new or reemerging groups. While top variants continue evolving to maintain dominance, the widespread impact of newer groups demonstrates the constant evolution of today’s threats and the need for adaptable defenses and increased cyber resilience.

The report explores a notable shift towards instability within the threat landscape and an increase in unnamed ransomware variants, potentially due to affiliates shifting between names to find the highest profits while reducing exposure to law enforcement. It also explores trends in ransom demands and payments across various industries. Finally, we discuss what may be coming in Q4 as the ransomware ecosystem continues to shift.

In the first half of 2023, Arete observed several distinct trends and shifts in the cyber threat landscape. Leveraging the data collected during each incident response engagement, we can see the rise and fall of ransomware variants, notable trends in ransom demands and payments, industries targeted by ransomware attacks, and what may be coming next. The threat landscape continues to evolve with the widespread introduction of AI tools, lower barriers of entry into cybercrime, new vulnerabilities, and the socioeconomic effects of the Russia-Ukraine war.

In this report, we’ve analyzed on-the-ground evidence collected while responding to nearly 1,500 ransomware events exceeding $1 billion in ransom demands. Through it all, we’ve helped our clients manage their response, minimize costs, and maintain business operations. And we hope this report helps many other organizations and insurers do the same.

Based on Arete case data, the commonly observed techniques and vulnerabilities of 2021 will likely not change through most of 2022. In the Arete Annual Crimeware Report, we will discuss: notable tactics and techniques observed in threat actor campaigns, notable negotiation insights gleaned from ransomware cases, how law enforcement has changed its games and how the threat landscape will evolve in 2022.

For many cybersecurity community, the past several months have been a dumpster fire. We’ve analyzed and tracked definitive data from more than 1,500 incident response and forensic cases over 12 months to provide unique visibility into the state of ransomware.

From Q2 to Q3 2021, ransomware gained increasing attention. In Q3 2021, threat actors also continued mass exploitation of vulnerabilities in systems, including those in Microsoft Exchange.