Loading story…
The US Treasury Department's Financial Crimes Enforcement Network (FinCEN) released a comprehensive report analyzing ransomware activity and payments from January 2022 to December 2024. The report revealed that over this three-year period, organizations reported 4,194 ransomware incidents and paid more than $2.1 billion in ransoms, nearly matching the $2.4 billion paid over the previous nine years. Ransomware payments peaked in 2023 at approximately $1.1 billion, followed by a significant decline to $734 million in 2024, a drop attributed to major law enforcement actions against prominent ransomware groups such as ALPHV/BlackCat and LockBit. Despite the decrease in payments, the number of reported incidents only slightly declined, indicating that while attacks remain frequent, fewer victims are paying ransoms.
The report highlighted that the manufacturing, financial services, and healthcare sectors were the most targeted, with financial institutions suffering the largest monetary losses. The vast majority of ransom payments (about 97%) were made in Bitcoin, and most funds were laundered through unregulated cryptocurrency exchanges. The median ransom payment peaked at $174,000 in 2023 before dropping to $155,257 in 2024. The data underscores the evolving nature of the ransomware threat landscape and suggests that coordinated law enforcement efforts can have a measurable impact on the financial incentives driving ransomware operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On December 8, 2025, multiple outlets reported the release of a U.S. Treasury Department FinCEN study summarizing ransomware payment trends, dominant variants such as ALPHV/BlackCat, Akira, LockBit, Phobos, and Black Basta, and the concentration of payments in Bitcoin.
FinCEN data shows reported ransomware payments dropped to about $734 million in 2024, down roughly 33% to 35% from 2023, while incident counts remained relatively steady at 1,476 versus 1,512 the year before. Manufacturing, financial services, and healthcare were the most targeted sectors.
U.S. and partner law enforcement actions against ALPHV/BlackCat and LockBit in 2023 and 2024 were cited as a major factor in reducing ransomware activity. Multiple reports say these takedowns contributed to lower incident and payment totals in 2024.
FinCEN data shows ransomware activity peaked in 2023 with about 1,512 incidents and roughly $1.1 billion in payments, the highest annual total in the reporting period. Median ransom payments were reported at about $174,000.
From January 2022 through December 2024, FinCEN recorded 4,194 reported ransomware incidents and more than $2.1 billion in payments. The report identified 267 unique ransomware variants during this period, with the top 10 accounting for about $1.5 billion.
FinCEN's report says it has tracked more than $4.5 billion in ransomware payments from 2013 through 2024, establishing 2013 as the start of the reporting period referenced in the study.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
fortra.com
Open sourcesecurityaffairs.com
Open sourcecyberscoop.com
Open sourcetherecord.media
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026
**Chainalysis’ 2026 Crypto Crime Report** assessed the 2025 ransomware economy and found that **on-chain ransomware payments fell ~8% year-over-year to about $820M**, even as **claimed attacks increased ~50%**. The report also observed a sharp rise in the **median ransom payment** (to roughly **$60K**, up several-fold from 2024), suggesting attackers are concentrating on larger, higher-value victims even as fewer victims pay overall. Chainalysis highlighted **Initial Access Broker (IAB)** activity as a potential leading indicator, noting that spikes in IAB-related inflows often **precede increases in ransomware payments and victim leak activity by ~30 days**, and it described increasing convergence in the “enablement” layer (e.g., shared use of **bulletproof hosting** and **residential proxy** services) across financially motivated and state-linked actors. Recorded Future News’ *The Record* reported additional metrics from the same Chainalysis analysis, including that the **victim payment rate dropped to a record low (~28%)** and that the $820M figure may rise toward **~$900M** as attribution improves (mirroring how 2024 totals increased after initial reporting). The article attributed the divergence between rising incident volume and falling payments to improved incident response, increased regulatory scrutiny discouraging payments, and law-enforcement disruption that has fragmented major ransomware operations into smaller groups—some using poorly designed malware that can be addressed with decryptors. Other items provided (a UAE claim of thwarting a “terrorist” ransomware campaign and a CSIS incident timeline covering multiple unrelated 2025 events) are not part of the Chainalysis 2025 ransomware-payment findings and do not materially corroborate that specific report’s conclusions.
Jun 29, 2026
Ransomware groups are experiencing a significant decline in payment rates, with only 23% of victims paying ransoms in Q3 2025, according to Coveware. This trend is attributed to organizations implementing stronger defenses, increased law enforcement pressure, and a growing understanding that paying to suppress stolen data offers little benefit. The average and median ransom payments have also dropped, with figures reaching $377,000 and $140,000, respectively. Ransomware-as-a-Service groups like Akira and Qilin are adapting by targeting different market segments, but even high-profile data exfiltration campaigns have yielded limited returns for attackers. As payments decrease, ransomware actors are shifting their tactics, focusing more on data exfiltration—now the primary objective in over 76% of observed attacks—and exploring new methods of initial access. Notably, there has been a rise in insider threats, with attackers bribing employees for credentials or remote access, and an evolution in helpdesk social engineering techniques. These changes reflect a more targeted and inventive approach by threat actors as they seek to overcome improved organizational defenses and maximize their chances of financial gain.
Jun 29, 2026