US is number one for ransomware attacks, 7x more than the next country

Following its 2023 State of Malware report back in February, Malwarebytes is out with its yearly State of Ransomware study. As attacks continue to grow, the US saw 7 times more ransomware incidents than the second most attacked country. Here are the details of what the report found.

Malwarebytes published its 2023 State of Ransomware report on its website. Looking at data collected between July 2022 and June 2023, the company found ransomware attacks have “surged” and that the US has taken the brunt of them.

To say ransomware gangs have been unkind to the US in the past year is an understatement.

The report says that 48 ransomware gangs have carried out 2,483 attacks against the top 10 most attacked countries. And the US has seen almost 60% of those with 1,462 in the last year alone.

Malwarebytes says that’s a “75 percent increase in the average number of monthly attacks in the US between the first and second half of the last 12 months.”

This chart visualizes much more the US is targeted than the other top attacked countries:

While the LockBit ransomware gang – who recently started targeting Macs – has historically been the leader in ransomware attacks, Malwarebytes says gang CL0P has outpaced LockBit in two of the last 12 months.

Here’s what Malwarebytes thinks is allowing CL0P to launch so many attacks:

The drive behind the sudden change? CL0P used separate zero-days in GoAnywhere MFT and MOVEit Transfer to gain an edge. This gave them the ability to launch an unprecedented number of attacks within a short time frame and across a massive scale.

The use of zero-day vulnerabilities by ransomware groups like CL0P may trigger a significant shift in ransomware strategies, mirroring the adoption of the “double extortion” tactic in 2019.

Looking at the broader picture, Malwarebytes says if other ransomware gangs mirror what CL0P is doing, it could “could skyrocket the number of victims.”

Read more on security:

• LockBit ransomware gang appears to be targeting Macs for the first time
• Hidden VNC tool gives attackers full access to Macs; comes with $100K guarantee
• Realst Mac malware targets macOS Sonoma; here’s how to stay safe
• ShadowVault macOS Stealer surfaces as the newest sophisticated Mac malware