Studies have shown that most attacks occur between 1:00 and 5:00 a.m.

Threat actors are taking advantage of off-duty time for security professionals to launch ransomware attacks, new research shows. Malwarebytes’ ThreatDown 2024 State of Ransomware report reveals that most incidents last year occurred between 1 a.m. and 5 a.m.

The report’s authors used data from the ThreatDown Managed Detection and Response team to conduct their research. They found that global ransomware attacks have increased by 33% over the past year, with the largest increases in countries that are the main targets. The UK saw a 67% increase in known attacks, while the US saw a 63% increase.

“The question I ask organizations is, ‘Do you have someone prepared to stop an attack at 2 a.m. on a Sunday morning, using existing technology and human resources?’” Chris Kissel, research vice president, Security & Trust Products, IDC, said in a press release.

“They may have a tool to receive alerts on Monday morning, but by then it will be too late. Threat actors move quickly to breach networks, extract data and deploy ransomware.”

Marcin Kleczynski, Founder and CEO of Malwarebytes, added: “Ransomware gangs have time and motivation on their side. They are constantly evolving to respond to the latest technologies chasing at their heels.

“We’ve seen this very clearly over the past year as the widespread adoption of technologies like EDR has helped identify attackers before they launch their malware, forcing ransomware gangs to work faster and put more effort into hiding. Organizations and MSPs need additional support and ongoing outreach to outsmart today’s criminals.”

Smaller ransomware groups are becoming more productive

The percentage of ransomware attacks carried out by small gangs outside the top 15 most active groups has increased from 25% to 31% in the past year, making ransomware attacks more accessible to less experienced attackers.

In January 2024, the UK’s National Cyber ​​Security Centre warned that the ransomware threat would likely grow even more due to the new availability of AI technologies that lower the barrier to entry. For example, Google Cloud analysts found that generative AI could be used in call centres conducting ransomware negotiations.

The Malwarebytes report also found that the percentage of ransomware attacks claimed by leading ransomware services group LockBit fell from 26% to 20% over the past year, despite more individual attacks being carried out.

SEE: 94% of ransomware victims have backups

LockBit’s dominance may have been undermined in February when the UK National Crime Agency’s Cyber ​​Division, the FBI and international partners effectively cut off access to its website, which was being used as a large ransomware-as-a-service site.

However, a few days later, the group resumed operations under a different dark web address and continues to claim responsibility for global ransomware attacks.

ALPHV, the second-largest ransomware group, also created a vacancy after a carelessly executed cyberattack on Change Healthcare in February. The group failed to pay an affiliate its share of a $22 million ransom, so the affiliate exposed them, prompting ALPHV to fake a law enforcement takeover and cease operations.

The authors write: “With ALPHV gone and LockBit’s future uncertain, other gangs will surely try to attract their partners and take their place as the dominant forces in the ransomware space.”

SEE: Report: The Impact of AI on the Cybersecurity Landscape

Industries most attacked by ransomware in the US and worldwide in 2024

Ransomware is a growing threat worldwide, with the number of businesses attacked expected to increase by 27% in 2023 and payouts topping $1bn (£790m) for the first time. Globally, ransomware damage costs are expected to top $265bn by 2031.

The services sector is the hardest hit, accounting for nearly a quarter of global ransomware attacks, according to a Malwarebytes report. A breach of critical national infrastructure can lead to widespread disruption, making it a prime target for ransomware attacks.

In May, the UK’s National Cyber ​​Security Centre and other international cyber authorities, including the FBI, warned of cyberattacks targeting operational technology providers, amid “sustained malicious cyber activity” targeting water, energy, food and agriculture companies between 2022 and 2024.

SEE: How Hackers Infiltrate Critical Infrastructure

The report also found that while the United States is responsible for almost half of all ransomware attacks worldwide, the country is responsible for 60% of global attacks on the education sector and 71% of those on healthcare.

This may have something to do with the highly privatized and therefore wealthy healthcare system and higher education institutions, as well as strict regulations like HIPAA and FERPA that pressure organizations to pay ransoms to avoid fines.

The global manufacturing sector saw a 71 percent year-over-year increase in ransomware attacks, reflecting increased software spending in the sector.

“The most likely explanation is therefore that the number of available targets in the manufacturing sector has increased over the past two years, perhaps due to the increasing digitalization in this sector,” the authors write.

Ransomware Attackers’ Tactical Changes in 2024

The ThreatDown MDR team has noticed an increase in Living-off-the-land techniques used by ransomware gangs such as LockBit, Akira, and Medusa. Living-off-the-land is the use of legitimate, pre-installed tools and software in the target environment during an attack in order to avoid detection.

This can reduce the overall complexity of malware by allowing an attacker to leverage existing features that have already been tested for security by an organization, and by making detection and prevention more difficult. The M-Trends 2024 report, produced by Google subsidiary Mandiant, also noted an increase in living-off-the-land attacks in May.

The M-Trends report also found that the median time attackers stay on target — the amount of time attackers remain undetected — across global organizations has decreased from 16 days in 2022 to 10 days in 2023.

Malwarebytes’ report also indicates a faster attack duration. ThreatDown Incident Response data shows that the entire ransomware attack chain—from initial data access to encryption—has shortened from weeks to hours.