More than half of all ransomware attacks worldwide are carried out by six criminal groups. With 21 attacks in the first half of the year, Belgium is the tenth most affected country in 2024.

A report from UNIT 42, the research group of Palo Alto Networks, shows that six ransomware groups are responsible for 53 percent of all ransomware attacks worldwide. Researchers analyzed 1,762 messages on leak sites where cybercriminals post stolen data. This number increased by four percent compared to the same period in 2023.

Ransomware groups

There are currently 53 active ransomware groups worldwide. The six most active groups, including Flighty Scorpius with LockBit 3.0 ransomware, Fiddling Scorpius with Play, and Dark Scorpius with BlackBasta, together account for more than half of all attacks. Many of these groups have ties to Russia. For example, the US government has offered a reward for information about Dmitry Khoroshev, the alleged leader of Flighty Scorpius.

Industry and healthcare

Hackers are primarily targeting sectors most affected by shutdowns. Manufacturing remains the largest target, accounting for 16 percent of all attacks in the first half of 2024. Healthcare saw a sharp increase in attacks, coming in second at 10 percent. The construction sector follows in third place with 9 percent.

Belgium in the top 10

Although the United States suffers the most attacks (52%), followed by Canada and the United Kingdom, Belgium ranks tenth worldwide with 21 ransomware attacks in the first half of 2024. This corresponds to one percent of all attacks.

The data is based on dark web analysis and may not provide a complete picture as not all victims see their data on leak sites.