Global cyber security and risk mitigation firm, NCC Group, has identified a considerable decrease in ransomware attacks in December 2021, with the total number of victims falling from 318 to 200.

Led by the Groups Strategic Threat Intelligence team, the change is a trend that NCC Group has seen in September and in previous years, and believes it is likely that there is a seasonal component to the 37% decrease in victim numbers.

Of the decreased overall activity, Lockbit and Conti continue be the two most prevalent threat actors in the ransomware space, with 47 and 32 attacks respectively in December.

Following PYSA's explosive increase in activity in November, when the malware group conducted 60 attacks, its activity dramatically declined in December to just one attack. The threat actor, which typically targets large or high-value finance, government and healthcare organisations, is a malware capable of exfiltrating data and encrypting users critical files and data.

 The PYSA activity decline is reminiscent of the decrease in activity of the threat actor Lockbit in September, after its extremely busy August. Therefore, this trend may indicate that PYSA has been focusing on victim communications and ransom collections in December as opposed to compromising new systems. NCC Group projects that PYSA will return to its usual frequency of operations in January, as Conti did in October. Its also expected that ransomware activity will increase in early 2022 following exploitation of the Log4j vulnerability, discovered in December.

Both North America and Europe continued to be the most targeted regions in December, with 81 and 70 victims respectively. In Europe, the top three targeted countries were the UK, France and Italy with 25, 13, and 9 attacks respectively.

The industrials sector continues to be the most impacted sector by a considerable margin of 40%. Meanwhile, the other main industry impacted was Consumer Cyclicals, accounting for 27% of the attacks in December. This sector includes automotive, housing, entertainment, and retail organisations.

Spotlight on ALPHV/BlackCat

At the closing stages of 2021, a new ransomware operation emerged called ALPHV, or BlackCat, which NCC Group considers to be a candidate for the most advanced ransomware it has ever identified.

The group uses several features that NCC Group analysts have never seen before. such as its Rust programming language that allows attacks to be customised. It also uses an affiliate scheme with the percentage fee as a cut, depending on the level of the ransom demanded. The group is using a triple extortion approach which involves encryption, data publication and DDoS. It also uses an access key as a token in a GET parameter in attacks, which means that only the affiliated parties can access the negotiation chats as the key cannot be distributed.

These sophisticated features are just a few examples of why ALPHV/BlackCat has been identified as another dangerous addition to the ransomware landscape. NCC Group plans to monitor its movements closely in 2022.

Matt Hull, cyber threat intelligence manager at NCC Group, said It is undoubtedly a positive to see a decrease in threat actor activity, however organisations should not take this as a sign that they should be complacent.

"Cyber criminals like many of us tend to reduce activity in seasonal times of year, and trends suggest that attack levels are likely to rise again in the coming months," he says.

"The emergence of ALPHV, also known as Blackcat, demonstrates that the vacuum created by the close of ransomware groups such as REvil and BlackMatter will be filled until further developments indicate otherwise.

"Organisations need to take action now to ensure they have robust incident response plans in to become resilient to future attacks especially those in targeted sectors such as Industrials and Consumer Cyclicals."