Which Ransomware Group Has Done the Most Damage in 2024?

Ransomware has evolved from a nuisance into a sophisticated and lucrative criminal enterprise, wreaking havoc across industries. While many cybercriminals dabble in ransomware, certain groups have become notorious due to the volume and success of their attacks. Among these are BlackCat/ALPHV, Qilin, and BlackBasta. Their operations, marked by high-profile attacks and hefty ransoms, reveal a chilling picture of modern cyber threats.

Let’s examine some of the most prolific and successful ransomware groups operating today.

BlackCat/ALPHV: The Pioneers of Ransomware Sophistication

Tactics and Techniques

BlackCat/ALPHV stands out for its sophisticated malware, which enhances its evasion capabilities. The use of Rust language makes their strains more difficult to detect and analyze, giving them an edge over traditional cybersecurity defenses. They leverage a Ransomware-as-a-Service (RaaS) model, allowing affiliates to conduct attacks while sharing profits. This decentralized approach enables widespread and coordinated attacks across various sectors.

Notable Targets

One of the most notorious attacks carried out by BlackCat/ALPHV in 2024 was on Change Healthcare. The disruption caused significant operational setbacks, highlighting the group’s ability to damage critical infrastructure. The attack not only encrypted vital healthcare data but also exposed sensitive patient information, exacerbating the impact and urgency of the situation.

As of February this year, the FBI believes BlackCat has compromised approximately 1,000 victim entities in the United States and elsewhere, including prominent government organizations. The Bureau is offering a reward of up to $15 million for “information leading to the arrest and/or conviction in any country of any individual conspiring to participate in or attempting to participate in BlackCat/ALPHV ransomware activities.”

Qilin: The Silent Yet Deadly Operator

Tactics and Techniques

Qilin operates with a lower profile than other groups but is equally effective. This sophisticated cyber threat group is believed to be of Russian origin. The gang stands out for its advanced techniques and cross-platform capabilities, including the use of double extortion tactics, which sees the group encrypt a victim’s data and also exfiltrate sensitive information. Its ransomware strains can target various operating systems, including Windows and Linux, enhancing its reach and versatility.

Primarily aiming for financial gain through extortion, Qilin targets sectors like healthcare and education, which rely heavily on critical data but often have lower cybersecurity defenses. By encrypting essential files and demanding a ransom, Qilin creates significant operational disruptions, compelling victims to pay to restore their systems.

Notable Targets

Qilin’s attack on the National Health Service (NHS) in the UK was a stark reminder of the vulnerabilities within the healthcare sector. The attack disrupted patient care and raised alarms about the security of critical health infrastructure. The incident highlighted the potential for ransomware to cause widespread harm by targeting essential services, underscoring the need for robust cybersecurity measures in the healthcare industry. While not as prolific as BlackCat, the group claimed to have demanded an eye-watering $50 million from pathology services company Synnovis.

BlackBasta: The Ruthless Operator

Tactics and Techniques

BlackBasta is known for its ruthlessness and efficiency. Like many other gangs, BlackBasta runs a RaaS model, working with initial access brokers who will usually already have a foothold on the network to begin their attacks. Once inside, they then pivot internally, employing a range of tools to advance their attack.

Their aggressive tactics include immediate data encryption and swift ransom demands, pressuring victims to comply quickly. They also exfiltrate sensitive information, threatening public release to persuade victims to pay quickly. According to the latest research, Black Basta has gradually shifted from using publicly available tools to custom-developed malware. To date, since its inception, the group has been extremely busy, amassing over 500 victims and more than $100 million in ransomware payments as of May 2024.

Notable Targets

BlackBasta’s attack on Ascension, a major healthcare organization, was a testament to its ability to target and disrupt critical services. The incident caused significant operational and financial damage, emphasizing the growing threat posed by ransomware groups. The attack on Ascension led to the encryption of patient records and operational data, severely hampering the organization’s ability to deliver healthcare services and manage patient care.

Also read: What Execs Should Know About Ransomware Attack Resilience

Success Factors of Ransomware Gangs

The success of these ransomware groups can be attributed to several factors:

• Top ransomware gangs employ advanced encryption methods, making it nearly impossible to retrieve data without paying the ransom. These techniques are often built on innovative technology and are continuously updated to evade detection by traditional cybersecurity measures.
• These groups meticulously choose their victims, often focusing on sectors with critical data and less robust cybersecurity measures. By targeting industries such as healthcare, entertainment, and finance, they ensure that the disruption caused by their attacks has significant repercussions, increasing the likelihood of the victim coughing up the ransom. In addition, the attacks on healthcare entities like Change Healthcare, the NHS, and Ascension highlight the susceptibility of critical infrastructure to ransomware. Disruptions in these sectors can have life-threatening consequences, emphasizing the urgent need for enhanced cybersecurity measures.
• They are adept at negotiating ransoms and understanding their targets’ financial capabilities. These groups often demand ransoms that are substantial yet within the victim’s financial reach, maximizing their chances of a payout.
• They also use a Ransomware-as-a-Service (RaaS) model that enables less skilled actors to carry out attacks, broadening the scope and scale of their operations. RaaS platforms provide affiliates with ready-made ransomware tools and even after-sales support, promoting the widespread distribution of ransomware and increasing the overall impact of the attacks.
• Beyond encrypting data, these groups often exfiltrate sensitive information, threatening to release it if the ransom isn’t paid, thereby increasing the pressure on their victims. This tactic, known as double extortion, adds another layer of coercion and significantly raises the stakes for targeted organizations.

The Evolving Nature of Ransomware

Fueled by sophisticated tactics, targeted attacks, and a ruthless approach to extortion, the success of ransomware groups like BlackCat/ALPHV, Qilin, and BlackBasta underscores the evolving nature of ransomware.

As these groups continue to adapt and innovate, organizations must bolster their cybersecurity measures to defend against these formidable adversaries. The battle against ransomware is ongoing, and staying informed about the tactics and targets of these groups is crucial in the fight to protect valuable data and infrastructure. By understanding the methods and motivations of these notorious ransomware groups, entities can better prepare for and respond to the ever-present threat of ransomware.