Ransomware 2024: New Tactics, Bigger Targets, Tougher Negotiations

Ransomware in 2024 is no longer just a simple encryption attack. Leading groups – LockBit, ALPHV/BlackCat, Cl0p – operate like businesses: with HR departments, support ticket systems, and contractually regulated affiliate programs. Underestimating them as “script kiddies” will lead to severe consequences.

TL;DR

Triple Extortion becomes standard: Encrypt + steal data + threaten DDoS as three combined levers.
RaaS ecosystem mature: Ransomware-as-a-Service enables even technically less skilled attackers to launch professional attacks.
Critical infrastructure in focus: Hospitals, energy, water – attacks on KRITIS are strategically increasing.
Negotiation professionalized: Specialized IR firms negotiate with attackers – this has become standard business practice.
Paying guarantees nothing: Only 65% of paying victims get all their data back (Cybereason).

The RaaS Model: How Ransomware Groups Operate

Ransomware-as-a-Service (RaaS) has dramatically lowered the barrier to entry for attackers. LockBit, for example, runs an affiliate program: partners receive the ransomware code and infrastructure, paying 20-30% of the ransom to the group. Initial Access Brokers (IAB) separately sell access to corporate networks – attackers simply purchase the access.

The result: attacks become more efficient and targeted. Before deploying ransomware, attackers typically spend weeks inside the network – collecting data, identifying backups, and escalating privileges.

LockBit Takedown and What It Shows

In February 2024, Operation Cronos by Europol, FBI, and NCA seized the LockBit infrastructure. Websites went offline, decryption keys were secured, and arrests were made. A significant blow – but LockBit was active again within weeks.

The lesson: ransomware groups are resilient. The technical infrastructure can be seized, but the knowledge, relationships, and money remain. Prevention is more important than waiting for law enforcement successes.

Incident Response in an Emergency: What Now Applies

First 24 hours: Isolate systems (do not shut down – preserve forensic evidence), activate IR service providers, inform BSI/CERT-Bund. Check reporting obligations under NIS2 and DSGVO.

Negotiation: Do not conduct it alone. Specialized firms (e.g., Coveware, Kivu, German IR firms) know the attackers and understand how negotiations realistically end. They also provide assessments of the seriousness of decryption.

Pay or not: A purely economic decision with risks on both sides. Restoring backups without paying often takes longer but can be technically feasible. Paying funds future attacks – that is also a consideration.

Key Facts at a Glance

Average Ransom Demand in 2023: ~1.5 million USD (Sophos State of Ransomware 2024)

Companies that pay: 56% of affected companies pay (Sophos 2024)

Data recovery rate after payment: 65% get all their data back

Average downtime: 24 days until full recovery

LockBit takedown: February 2024 through Operation Cronos (Europol/FBI)

Fact: The average downtime after a ransomware attack is 23 days, according to Sophos.

Fact: The average damage from a ransomware attack in 2024 was $1.54 million, according to Coveware.

Frequently Asked Questions

What is Ransomware-as-a-Service (RaaS)?

RaaS is a business model where ransomware developers rent out their code and infrastructure to “affiliates.” The affiliates carry out attacks and pay a share of the ransom to the developers. This drastically lowers the technical barrier to entry.

Should you pay the ransom?

This is an individual decision with many factors: availability of backups, type of stolen data, reputation, insurance coverage. Paying is not forbidden in the EU but funds criminal activities. Not paying can lead to data publication.

What is an Initial Access Broker?

IABs are specialized attackers who sell access to corporate networks – without deploying ransomware themselves. They buy or steal access data and distribute it on the darknet. Ransomware groups purchase these accesses as a “starting point.”

How does network segmentation protect against ransomware?

Ransomware spreads laterally within the network. Segmentation (VLANs, micro-segmentation, zero-trust network) prevents a compromised endpoint from infecting the entire network. Keeping backups in an isolated segment is also critical.

What should a ransomware response plan include?

Clear roles (who decides?), contacts with IR service providers and BSI, communication plan (internal, external, media), technical playbooks for isolation and forensics, and regular exercises (tabletop exercises).

→ Ransomware 2026: Incident Response in the First 60 Minutes

→ What Was Important in Cybersecurity in 2024

About the author: Tobias Massow

Read article

ransomware