The ransomware industry experienced a significant decline in 2024, with payments decreasing by 35% compared to the previous year, as reported by Chainalysis.

Despite an increase in ransomware attacks, the total revenue from these operations dropped to $814 million from $1.25 billion in 2023. The report attributes this downturn to heightened law enforcement actions, sanctions, and a rising sentiment among victims to refuse payments. According to Jacqueline Burns Koven, Chainalysis’ head of cyber threat intelligence, the trust in attackers’ assurances regarding data deletion has waned.

For instance, United Healthcare paid a ransom of $22 million to the Russian ransomware group BlackCat, only to have the data leaked post-payment. “What it illuminated is that payment of a ransom is no guarantee of data deletion,” Koven stated.

Additionally, operational disruptions due to sanctions on various ransomware entities have also contributed to this reluctance among victims. Lizzie Cookson, from Coveware, noted the improvement in cyber hygiene among victims, allowing many to resist demands from attackers more effectively.

Moreover, the report highlights a notable decrease in the use of crypto mixers by attackers, indicating their struggle to launder funds due to increasing legal pressures.

Koven cautioned that while the current trends show promise, it might be premature to celebrate, as the forces driving attacks still remain in place for potential escalation. You can read the full report here.