Ransomware attacks are a major and expensive problem for companies. After an attack, it takes on average up to a month for the company to return to normal operations. Lockbit 3.0 is the most active hacker group in the world.
aDvens, one of the leading independent cybersecurity companies in Europe, has published its annual Threat Status Report. The report provides a detailed overview of the most important developments and trends in cyber threats observed by the aDvens team of experts, as well as the relevant protection measures against these threats.
The most important findings from the report at a glance:
Ransomware worldwide
- After the number of ransomware attacks worldwide fell in 2022 for the first time in 5 years, aDvens recorded an increase of 2023 percent in 12 compared to the previous year.
- The hacker group Lockbit 3.0 was by far the most active worldwide in 2023 (1.038 victims), followed by AlphVM (422 victims) and Cl0p (386 victims).
- On average, it took three to four weeks for a company attacked with ransomware to return to normal operations.
Ransomware in Germany
- In a global comparison, companies in Germany were the fourth most frequently attacked using ransomware. aDvens recorded 215 cyber attacks.
- Lockbit 3.0 was also the most active in Germany (39 attacks), followed by BlackBasta (29 attacks) and Cl0p (17 attacks).
- Companies in the mechanical engineering sector were most frequently attacked (15 victims), followed by the construction industry (10 victims), the automotive industry (9 victims) and the electronics manufacturing industry (9 victims).
Attackers rely on efficiency
- The average time for a ransomware rollout has dropped massively – from around two months in 2019 to less than four days in 2023.
- The technically simplest attack methods are still the most commonly used. These include phishing, compromising third-party services, targeted use of existing vulnerabilities and DDoS attacks.
- Attackers are increasingly acting opportunistically and are specifically focusing on particularly risky security gaps, such as unofficial “shadow IT” within the company, which is less protected.
Attackers use new methods to monetize data
- Fewer and fewer companies are paying the ransom demanded in ransomware attacks: Instead of encrypting data and then demanding a ransom, attackers are increasingly using spyware to steal data and then sell it (or threaten to sell it) on the darknet.
About aDvens
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a monthaDvens is a leading, independent European cybersecurity company. Since its founding in 2000, the company's name has been its mission statement. aDvens stands for "Together and Ahead". Its mission is to protect public and private organizations from cyber threats - around the clock. aDvens offers Managed Detection & Response Services (SOC-as-a-Service) and selected consulting services in the field of cybersecurity and OT security.