1、RAPID7RANSOMWARE RADAR REPORT2024Rapid7 Labs2CONTENTSExecutive Summary 3Ransomware Group Trends 5An examination of active groups 7Knock KnockInitial Access 10Encryption Algorithm Trends 13AES(Advanced Encryption Standard)14Cha Cha 14RC4 14A few words on Sosemanuk 15Ransomware Code Insights 16 13Prog

2、ramming language/framework distribution 19Conclusion 203The first half of 2024 has witnessed a substantial evolution in the ransomware ecosystem,underscoring significant shifts in attack methodologies,victimology,and cybercriminal tactics.Rapid7 Labs has tracked more than 2,570 ransomware incidents

3、so far this year,equating to an average of 14 publicly-claimed incidents per day.Since many incidents continue to go unreported,the actual numbers are likely much higher.Ransomware knows no borders and neither do the groups unleashing it.Rather than picturing these groups as a collection of individu

4、als in hoodies,we must extend our collective imagination to fathom the international business model that delivers the end product ransomware to our doorsteps.This research report provides a comprehensive analysis of ransomware incidents and binaries recorded and gathered globally,offering insights i

5、nto trends,attacker profiles,ransomware families,and the implications for cybersecurity defenses.The data used for this report comes from Rapid7s incident response teams and independent Rapid7 Labs research.The ransomware sample dataset we used consists of(i)prevalent and available ransomware famili

6、es from 2023 which continued their operations into 2024,and(ii)new 2024 ransomware samples that were observed until the end of June,2024.EXECUTIVE SUMMARY2,570+in the first half of 202414publicly-claimed incidents per day4KEY FINDINGS:4WELCOME TO THE PARTY:Within the first six months of 2024,Rapid7