New analysis from NCC Group's Global Threat Intelligence team has revealed that ransomware attacks are soaring, with 436 victims in May. The new figures represent a 24% surge compared to April's figure of 352 and a 56% increase compared to May 2022.

The spike in activity was, in part, driven by the emergence of 8base, a new ransomware player that employs a double extortion strategy, publicizing the data of 67 victims in May.

Other results include:

  • 436 attacks in May — the second highest monitored by NCC Group’s Global Threat Intelligence team in 2023
  • Industrials (30%), Technology (15%) and Consumer Cyclicals (11%) most targeted sectors
  • Regional data shows North America (51%) most targeted region, followed by Europe (24%), Asia (8%) and South America (8%)

Threat actors

Lockbit 3.0 were responsible for 18% (78 victims) of the attacks in May and remains the most active threat actor in 2023, despite a 27% drop in attacks compared to April (107 victims).

Newly discovered threat actor 8base were responsible for 15% of the attacks in May, as the group began releasing data from victims breached between April 2022 and May 2023. Its attacks typically involved stealing and encrypting data, with more than half its victims (52%) operating in the Industrials sector.

Elsewhere, Akira, a threat actor first discovered in March, carried out 28 attacks — their highest on record and a 250% increase compared to April (6 victims). NCC Group’s Global Threat Intelligence team also monitored activity from new ransomware groups BlackSuit, MalasLocker and RAGroup.

Regions 

In May, North America was the target of over half (51%) of the monitored incidents, with 222 victims, followed by Europe (24%) with 106 victims. South America (8%) experienced a significant surge with 34 attacks, an 89% increase compared to April, largely driven by 8base's disclosure of 15 victims in the region.

Sectors

Industrials (30%) remained the most targeted sector with 131 attacks, as threat actors continue to target lucrative personally identifiable information and intellectual property. Technology (15%) saw a 78% increase in attacks compared to April, with 66 victims; while Consumer Cyclicals (11%) was the target of 37 attacks.