Wednesday , June 4 2025
Ransomware
Ransomware red button on keyboard, 3D rendering

Corvus threat intel report
Ransomware Attacks Up More Than 95% Over 2022

In its Q2 2023 Global Ransomware Report, Corvus noted a significant resurgence in global ransomware attacks, which has continued through the third quarter. Now, with two months remaining in the year, the number of ransomware victims in 2023 has already surpassed what was observed for 2021 and 2022. If the trajectory continues, 2023 will be the first year with more than 4,000 ransomware victims posted on leak sites (2,670 in 2022).

           Corvus Threat Intel report

2023 has already seen more ransomware victims than all of 2021 and 2022 combined. If this trend continues, there could be over 4,000 ransomware victims posted on leak sites this year.

New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

In March 2025, the Threatfabric mobile Threat Intelligence team identified Crocodilus, a new Android banking Trojan designed for device takeover....
Read More
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries

Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Qualcomm has issued security patches for three zero-day vulnerabilities in the Adreno GPU driver, affecting many chipsets that are being...
Read More
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks

Critical RCE Flaw Patched in Roundcube Webmail

Roundcube Webmail has fixed a critical security flaw that could enable remote code execution after authentication. Disclosed by security researcher...
Read More
Critical RCE Flaw Patched in Roundcube Webmail

Hacker claim Leak of Deloitte Source Code & GitHub Credentials

A hacker known as "303" claim to breach the company's systems and leaked sensitive internal data on a dark web...
Read More
Hacker claim Leak of Deloitte Source Code & GitHub Credentials

CISA Issued Guidance for SIEM and SOAR Implementation

CISA and ACSC issued new guidance this week on how to procure, implement, and maintain SIEM and SOAR platforms. SIEM...
Read More
CISA Issued Guidance for SIEM and SOAR Implementation

Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

The Qualys Threat Research Unit (TRU) found two local information-disclosure vulnerabilities in Apport and systemd-coredump. Both issues are race-condition vulnerabilities....
Read More
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora

Australia enacts mandatory ransomware payment reporting

New ransomware payment reporting rules take effect in Australia yesterday (May 30) for all organisations with an annual turnover of...
Read More
Australia enacts mandatory ransomware payment reporting

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious new security rules that require...
Read More
Why Govt Demands Foreign CCTV Firms to Submit Source Code?

CVE-2023-39780
Botnet hacks thousands of ASUS routers

GreyNoise has discovered a campaign where attackers have gained unauthorized access to thousands of internet-exposed ASUS routers. This seems to...
Read More
CVE-2023-39780  Botnet hacks thousands of ASUS routers

Bangladesh Bank instructed using AI to prevent online gambling

The rise of online gambling in the country is leading to increased crime and societal issues. In response, the central...
Read More
Bangladesh Bank instructed using AI to prevent online gambling
     Corvus Threat Intel report
Note that this is not the complete picture. Victims who are listed on leak sites usually do not pay or delay paying a ransom. However, a significant portion of victims, estimated to be between 27% – 41%, promptly pay the demands of threat actors and therefore are not seen on leak sites.
As a result, the total number of businesses affected by ransomware could be approximately 5,500 – 7,000 in 2023.

Factors Contributing to the Global Ransomware Surge

CL0P Mass Exploits Peaked:

CL0P, a previously quiet ransomware group, became active in Q1 by exploiting GoAnywhere file transfer software and impacting over 130 victims. In Q2, they targeted MOVEit file transfer software using a zero-day vulnerability, affecting 264 victims. This single vulnerability accounted for 9% of Q2’s total and 13% of Q3’s victims, significantly contributing to an increasing victim count.

However, even without CL0P, ransomware numbers increased by 5% compared to the previous quarter and 70% compared to the previous year in Q3.

The graph below illustrates the significant impact of a single group like CL0P, which was once relatively quiet.

Prior to 2023, CL0P only had a small number of ransomware victims. Now, they make up a considerable share of the total. A single opportunity for mass exploitation can lead to record-breaking results for a ransomware group.

        Corvus Threat Intel report
The grey bars show the activity of ransomware groups, excluding CL0P. These bars have been increasing steadily in 2023. Even without CL0P, ransomware activity is increasing.
Each quarter of this year has been higher than the previous one. Based on past trends, Q4 is expected to be worse than Q3.
     Corvus Threat Intel report
LockBit and ALPHV (BlackCat) reduced the number of victims on their leak sites by around 50% from April to July 2023. However, the latest numbers from late Q3 and early Q4 indicate that ransomware groups are returning to their usual activities and are expected to cause more harm in Q4.
  Corvus Threat Intel report

 

 

Check Also

CCTV

Why Govt Demands Foreign CCTV Firms to Submit Source Code?

Global makers of surveillance gear have clashed with Indian regulators in recent weeks over contentious …

Leave a Reply

Your email address will not be published. Required fields are marked *