iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ransomware activity expanded across several measures around Black Hat USA 2024, but the evidence does not show that every gang’s profits kept rising. Rapid7 counted more leak-site posts and active groups in the first half of 2024 than a year earlier; later, FinCEN reported lower BSA-reported ransomware payments in 2024 than in 2023. Those figures measure different things. Posts and victim announcements are not proof of payment, and payments are not criminal net profit.
What the Black Hat-era figures show
Rapid7 released its Ransomware Radar Report on August 6, 2024, alongside its Black Hat USA presence. It analyzed attacker activity over the 18 months ending June 30, 2024. Its figures describe activity observed through ransomware leak sites, not a count of every attack or a ledger of money collected.
- Rapid7 counted 2,611 leak-site posts from 68 groups between January and June 2024, 23% more posts than in the first half of 2023. A post represents an extortion attempt in Rapid7’s analysis; it does not establish that the victim paid.
- Rapid7 observed an average of 40 groups posting to leak sites per month in the first half of 2024, compared with 24 per month in the first half of 2023.
- It reported 21 new groups surfacing in the first six months of 2024, including rebrands. RansomHub made 181 leak-site posts from February 10 through June 30, 2024.
These are indicators of a busy, changing ecosystem, not evidence that every group became more profitable. A group can post more claims without collecting more ransom, and leak-site activity does not reveal the full set of incidents.
Recommended Free Tools
Why reports give different counts
Ransomware datasets use different collection methods and time windows. Their numbers should be read separately rather than combined into a single trend line.
#1 Best Overall
- Trusted By Families Worldwide - With Over 50 Million Sold, Thinkfun Is The World's Leader In Brain And Logic Games
- Develops Critical Skills - Playing Through The Challenges Builds Reasoning And Planning Skills As Well As Core Programming Principles, And Provides A Great Stealth Learning Experience For Young Players
- What You Get - Hacker Is A Cybersecurity Coding Game And Stem Toy For Boys And Girls Age 10 And Up Where You Learn Programming Principles Through Fun Gameplay. It Includes A Game Grid, Control Panel, Challenge Booklet, 2 Agent Tokens, 9 Movement Tiles, 13 Revolving Platform Tiles, 5 Double-Sided Transaction Tiles, A Transaction Link Token, 3 Data File Tokens, 2 Exit Point Tokens, A Virus Token, Alarm Token, 2 Lock Tokens, And A Solution Booklet
- Clear Instructions – Easy To Learn With A Clear, High Quality Instruction Manual. You Can Start Playing Immediately
| Source and period | What it counted | What the figure means |
|---|---|---|
| Rapid7, January–June 2024 | 2,611 leak-site posts by 68 groups | Extortion attempts posted to sites tracked in Rapid7’s analysis, not confirmed payments or all incidents. |
| Black Kite Research Group, April 2023–March 2024 | 4,893 confirmed victim announcements, compared with 2,708 in the preceding year | Announcements tracked by Black Kite, not a census of all attacks. The period differs from Rapid7’s and FinCEN’s. |
| FinCEN, January 2022–December 2024 | 4,194 ransomware incidents in BSA reports and more than $2.1 billion in reported payments | Financial-institution reporting, not a complete global count of incidents or criminal revenue. |
| Sophos 2024 survey, summarized by Black Hat MEA | Survey responses on ransom payments and recovery costs | Survey averages among participating organizations, not amounts paid by every victim. |
Black Kite’s tracked victim announcements increased across its defined study windows, while FinCEN’s reported payment total fell from 2023 to 2024. These findings do not contradict each other: an announcement is not a financial filing, and the periods, populations and measures differ.
How ransomware groups adapted their operations
Rapid7 described groups using business-like tactics, including marketing services to prospective buyers, offering insiders commissions for access, and running bug bounty programs. Its analysis also identified three clusters of ransomware families with similar source code, which Rapid7 interpreted as a sign of development toward more specialized variants. These are findings from Rapid7’s analysis, not a description verified for every group.
Rank #2
- Quick and Easy Setup: Get the fun started in minutes! No Escape Board Game is suitable for board game party nights with kids, teenagers, and adults. Easy setup ensures more time for an exciting space escape adventure
- Dynamic Maze Runner Game: Every game feels unique! Experience a thrilling maze runner game with dynamic tile laying and action-packed sequences. Suitable for 2-8 players board games sessions that keeps everyone on their toes
- Engaging Space Station Games: Dive into the depths of the space station with our board games for 2-8 players. The No Escape Board Game offers a captivating escape board game experience with strategic gameplay and endless fun
- Party Board Game Night: Bring excitement to your next party board game night! With quick setup and easy-to-learn rules, this escape board game is suitable for kids' birthdays, teen hangouts, or adult gatherings
- Action-Packed Maze Escape: Combine strategy with luck and navigate through the maze escape. A premium experience that includes high quality piece of dice, meeples, and tiles
Ransomware-as-a-service (RaaS) models let operators and affiliates divide roles, and changing group names can reflect rebranding or movement within that ecosystem. Black Hat MEA’s July 2024 overview discussed LockBit, 8Base and Phobos: it described double extortion as stealing and encrypting data before coercing a victim, 8Base’s name-and-shame approach, and Phobos’s use of RaaS tools. The overview reported that LockBit’s infrastructure was seized in February 2024 and that the group resumed activity soon afterward. That is a dated account, not a current status report.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow much ransom are cybercriminals asking for?
A demand is only a request. It is not necessarily accepted, paid in full, or retained as profit. The available figures answer different financial questions:
Rank #3
- A fast-paced game of deception and betrayal
- Beautiful wooden components
- Solid game boards with foil inlay
- Hidden roles and secret envelopes for five to ten players
- FinCEN’s payment totals: FinCEN’s 2025 release says BSA reports covered more than $2.1 billion in ransomware payments across 4,194 incidents from January 2022 through December 2024. Its reported payment total was $1.1 billion in 2023 and $734 million in 2024. FinCEN noted that reported incidents and payments fell in 2024 following law-enforcement disruption of two prominent groups. These are payments represented in BSA filings, not a complete global account of criminal revenue.
- Sophos survey averages: Black Hat MEA’s July 2024 article summarized Sophos’s State of Ransomware 2024 survey. It reported an average ransom payment of $2 million among surveyed organizations, compared with $400,000 in 2023, and an average recovery cost of $2.73 million. These are survey results, not a claim that every affected organization paid those amounts.
- Victim recovery costs: Recovery costs are expenses on the victim’s side and can be separate from any ransom payment. They should not be added to attacker revenue.
“Profit” would require accounting for what criminals actually collected, operating costs, affiliate and operator splits, seized or unpaid funds, and other losses. The figures above do not provide that accounting, so they cannot establish that ransomware gangs’ net profits rose overall.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organizations can take from the trend
The reports support a picture of an adaptable and commercially organized criminal ecosystem, with rebrands, affiliate activity and varied forms of extortion. They do not establish a single global attack count or a continuous rise in every group’s income. For organizations, incident-response planning and tested backup and disaster-recovery arrangements are relevant preparation; the activity figures are not a substitute for assessing an organization’s own risks and recovery needs.
Quick Recap
Best Value
- CATCH THE CHAMELEON: A bluffing board game where players must race to catch the chameleon before It's too late
- ONE SECRET WORD: In this board game for adults and family everyone knows the secret word - except for the player with the chameleon card
- DON'T GET CAUGHT: Use hidden codes, carefully chosen words, and a bit of finger-pointing to track down the guilty player... Before the imposter blends in and escapes!
- EASY TO LEARN, QUICK TO PLAY: Like all good family board games, it takes 2 minutes to learn and only 15 minutes to play. Recommended for 3-8 players and ages 12+
- MULTI-AWARD WINNING: "Best Party Game" At UK games expo. "Seal of excellence" From dice tower games. A perfect board game for adults and teenagers
Rank #4
- THE ADULT VERSION OF CLUE YOU'VE BEEN WAITING FOR: Lie to your friends, get away with murder! The Clue Conspiracy game is a secret role strategy game of shifting suspicions—with a party vibe! Ages 14+. For 4-10 players
- AN ISLAND SETTING, A NEW VICTIM: You're invited to the tropical Black Adder Resort, where a guest (maybe even you!) is trying to murder its manager, Mr. Coral. Deadly traps are spread throughout the resort grounds—and someone is armed
- PLAY ON SECRET TEAMS: Players play as Clue characters and take on secret roles on opposing teams: Friends vs. the Conspiracy. Friends try to keep Mr. Coral alive, while Conspiracy members secretly try to set up his murder
- WHO CAN YOU TRUST?: Lie, bluff, sabotage! In this mystery game, it's all about mind games as players conspire, gather clues, share info (or not), and call each other out to stop the other side
- MULTIPLE WAYS TO WIN: The Conspiracy wins by pulling off the murder Plot at a specific location or secretly sabotaging and setting off traps. The Friends win by disarming all the traps, or if that fails, solving the WHO, WHERE, and WHAT of the secret Plot
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
