Ransomware attacks on state and local governments have dropped by 51% in 2024, due to fewer governments paying ransoms, making them less attractive targets to cyber criminals.
Law enforcement has played a significant role in disrupting major ransomware operators, contributing to the decline in ransomware attacks. These operations did not eliminate the groups entirely but dealt severe blows to their operations by disrupting their infrastructure and identifying key members.
The decline in ransomware attacks is largely tied to a fundamental change in how governments are responding to these attacks, with a growing awareness about the risks of paying ransoms, coupled with increased support from the Cybersecurity and Infrastructure Security Agency (CISA), leading to a more cautious approach.
While the number of ransomware attacks has decreased, the cost of recovering from these attacks has skyrocketed, with the average recovery cost for state and local governments in 2024 reaching $2.83 million, more than double the $1.21 million reported in 2023.
One of the more interesting trends in 2024 has been the rise of unaffiliated ransomware actors, often referred to as “lone wolves.” These attackers operate independently of established ransomware brands like LockBit or BlackCat, making it more challenging to attribute attacks to a specific group.
Enterprises, critical infrastructure organizations and government agencies must focus on defending against the tactics, techniques and procedures (TTPs) of ransomware attacks, rather than simply tracking the movements of known groups. They should remain vigilant about the possibility of unaffiliated actors targeting their systems.
The increased involvement of law enforcement and the reluctance of governments to pay ransoms are positive developments, but they do not signal the end of the ransomware threat. Now is the time for organizations to ramp up their cybersecurity efforts.