2024

when

Criminals made off with a record $1 billion in cryptocurrency ransomware payments in 2023 as high-profile institutions and infrastructure were targeted by sophisticated attacks.
According to the latest excerpt from Chainalysis’ 2024 “Crypto Crime Report” focusing on ransomware, significant supply chain attacks occurred using <a href="https://www.cisa.gov/news-events/alerts/2023/06/07/cisa-and-fbi-release-stopransomware-cl0p-ransomware-gang-exploits-moveit-vulnerability" target="_blank" rel="noopener nofollow">ubiquitous file transfer software MOVEit</a>, which affected household names like the BBC and British Airways.
A contributing factor to the resurgence of ransomware in 2023 was an escalation in the “frequency, scope, and volume of attacks.” Various actors carried out attacks, from individuals and small criminal groups to large syndicates.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/16b69d3e-37dd-4c86-927f-d04bd7f212fb.png" alt="" title="">
 <figcaption style="text-align: center;">
 Annual ransom payments reached new all-time highs in 2023, surpassing $1 billion. Source: Chainalysis
 </figcaption>
</figure>
Chainalysis cites data and insights from cybersecurity firm Recorded Future, which reported 538 new ransomware variants in 2023. The report also provides visualizations of the different ransomware strains by payment size and frequency, illustrating the variety of criminal strategies.
Related:&nbsp;<a href="https://cointelegraph.com/news/how-the-irs-seized-10b-worth-of-crypto-using-blockchain-analytics">How the IRS seized $10B worth of crypto using blockchain analytics</a>
The report notes that ransomware groups such as&nbsp;<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a" target="_blank" rel="noopener nofollow">CL0P</a>&nbsp;exhibited a “big game hunting” strategy that carried out fewer attacks when compared to other ransomware strains but collected larger payments with each attack:
<blockquote data-ct-non-breakable="true">
 “Cl0p leveraged zero-day vulnerabilities that allowed it to extort many large, deep-pocketed victims en masse, spurring the strain’s operators to embrace a strategy of data exfiltration rather than encryption.”
</blockquote>
Meanwhile, ransomware groups like Phobos essentially operate a <a href="https://www.chainalysis.com/blog/ransomware-raas-cryptocurrency-2019/" target="_blank" rel="noopener nofollow">ransomware-as-a-service (RaaS)</a> model, which allows criminal affiliates to access the malware to carry out attacks. The core operators then earn a cut of the ransom proceeds.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/748bb722-e35d-4741-ba82-1dd51bc1af67.png" alt="" title="">
 <figcaption style="text-align: center;">
 A visualization of ransomware strains by average payment size and frequencies.&nbsp;Source: Chainalysis
 </figcaption>
</figure>
Chainalysis describes this model as typically targeting smaller entities with lower ransoms, banking on a large quantity of smaller attacks serving as a force multiplier to extract funds.
Ransomware attackers also frequently rebrand and create overlapping strains to distance themselves from previously identified strains linked to sanctions and investigations. Chainalysis uses blockchain analysis to show on-chain links between wallets of different ransomware strains.
Zero-day vulnerabilities were also a significant contributor to high-impact ransomware incidents in 2023. These attacks typically target security gaps in a company’s service, system, product or application before developers can create and distribute a fix.
Related:&nbsp;<a href="https://cointelegraph.com/news/criminals-prefer-stablecoins-over-bitcoin-for-illicit-use">Bitcoin no longer asset of choice for criminals — Former Elliptic crypto advisor</a>
CL0P’s exploit of the file transfer software MOVEit in 2023 was a prime example, given that its product is used by various IT and cloud applications and exposed the data of hundreds of organizations and millions of users.
The campaign allowed CL0P to become the most prominent ransomware strain across the ecosystem. In June and July 2023, the strain amassed over $100 million in ransom payments, accounting for 44.8% of the ransomware value.
2023 saw cross-chain bridges, instant exchangers, mixers and underground exchanges being used to launder a larger share of funds fleeced through ransomware attacks.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-02/4a7f2841-55ba-4681-9dc9-166662af18d8.png" alt="" title="">
 <figcaption style="text-align: center;">
 The different avenues that criminals use to launder cryptocurrency ransomware payments.&nbsp;Source: Chainalysis
 </figcaption>
</figure>
Chainalysis also touches on the evolving nature of the movement of stolen funds from ransomware attacks. Centralized exchanges and mixers have historically received the majority of ransomware funds to be laundered.
Magazine:&nbsp;<a href="https://cointelegraph.com/magazine/blockchain-detectives-mt-gox-collapse-birth-chainalysis/">Blockchain detectives: Mt. Gox collapse saw birth of Chainalysis</a>

Ransomware returns: Chainalysis flags record $1B payments in 2023

Cointelegraph

Other articles published on Feb 7, 2024

Dogecoin Kicking Into Overdrive As DOGE Wallets Grow at Fastest Rate in History: Santiment

Dymension (DYM) Price Jumps 50% Amid Mainnet Launch and Airdrop

Jupiter Price Prediction: Solana Token JUP Bounces Back With 8% Surge, But Analysts Say Consider ...

Rebel Satoshi Gains Momentum as Traders Shift Focus from Litecoin AAVE and Bitcoin Cash

Ethereum whale on the move amid Holesky Test Success

UBS Launches Hong Kong’s First Investment-Grade Tokenized Warrant on ETH Blockchain

Join our free newsletter for daily crypto updates!