Somewhere around July 2024, the ransom note stopped working.
Understand what it replaced. For most of a decade, ransomware ran on a fixed script: attackers encrypted a victim's files, named a price in cryptocurrency, and got paid. Payment was the rational exit. 2024 is the year the alternatives changed.
The year the money stopped
The first half looked like business as usual — worse, actually: extortion payments reached $459.8 million between January and June, about 2.4 percent higher than the same period in 2023, including a record-breaking $75 million payment to the Dark Angels group. Then payment activity slowed by roughly 35 percent after July, while attacks did not: Chainalysis found ransomware events actually increased in the second half even as on-chain payments fell.
Attackers launched more attacks than ever in 2024 and collected dramatically less money: approximately $813.55 million, down 35 percent from 2023's record $1.25 billion — the first annual decline since 2022. In the second half there was a 53 percent gap between what attackers demanded and what victims sent. Those who did pay typically sent between $150,000 and $250,000, regardless of the opening demand.
The receiving end saw the same year
The FBI's 2024 Internet Crime Report tells the story from the other side of the ransom note: IC3 logged 3,156 ransomware complaints in 2024, up 9 percent from 2,825 in 2023, and again named ransomware the most pervasive threat to American critical infrastructure. Nearly half of all complaints involved critical infrastructure organizations — critical manufacturing, healthcare, government facilities, financial services and IT hit hardest. Total reported cybercrime losses reached $16.6 billion, up 33 percent.
More complaints. More total losses. And still the ransomware economy shrank. The extortion business specifically — not cybercrime in general — is what lost ground. Victims reported more and paid less — the two curves defenders have been trying to bend for years, bending at the same time.
Part of the squeeze happened on the criminals' side of the ledger. Jacqueline Burns Koven, Chainalysis's head of cyber threat intelligence, said directly: "Ransomware operators, a primarily financially motivated group, are abstaining from cashing out more than ever. This potentially indicates a fear of being traced, identified, and prosecuted by law enforcement agencies, made possible with the help of crypto investigation tools." Money that can't be safely spent is worth less. Sanctions against ransomware-linked exchanges and seizures of money-laundering infrastructure made cashing out riskier still.
A ransom that sits frozen in a wallet isn't revenue in any useful sense. It's evidence.
Three forces did the squeezing
The first force was resilience, years in the making: organizations finally built the recovery capability that makes payment unnecessary. "Organizations have increasingly implemented comprehensive data backup solutions, so the business can rapidly recover their systems through a wipe-and-restore process," said Christian Geyer, CEO of incident response firm Actfore, speaking to Dark Reading. Better backups, tested restores, practiced response — the pay-or-rebuild calculation tipped decisively toward rebuild.
The second force wore a badge. Since 2022 the FBI has provided thousands of decryption keys to victims, helping them avoid more than $800 million in ransom payments. The bureau's own advice hasn't softened: it has long advised against paying, noting that payment funds criminal activity and does not guarantee recovery, and asks instead for a report to IC3 or a local field office. But that reporting now comes with practical help attached: increasingly, a complaint is how victims end up with a decryption key instead of a ransom demand.
The third force sat in the boardroom. Cyber insurers tightened underwriting, public breach-disclosure rules made quiet settlements harder to bury, and boards began treating a ransom payment as a governance failure rather than a pragmatic shortcut. Put it together and only around 30 percent of ransomware negotiations now end in payment.
Law enforcement didn't just squeeze the money. In early 2024 it broke the two biggest machines. In February, the UK's National Crime Agency and the FBI led an international operation against LockBit, then the world's most prolific ransomware-as-a-service operation; LockBit's second-half payments fell approximately 79 percent. A month earlier, in January 2024, ALPHV/BlackCat — among 2023's top-grossing strains — collapsed when its own operators pulled an exit scam, stealing their affiliates' ransoms and vanishing.
What happened next matters more than the takedowns themselves: in previous years, when a major group fell, another absorbed its affiliates and market share within months. This time no single successor emerged; the field fragmented into smaller players. Akira, which had targeted more than 250 entities since March 2023, was the only first-half top-ten strain to increase its activity in the second half. Newcomers like RansomHub, FOG and PLAY joined it among the five most active groups the FBI named for 2024. Understand the model that broke, because it explains the fragmentation. LockBit was a ransomware-as-a-service operation: a core crew maintained the malware and infrastructure, and affiliates did the breaking in, sharing the proceeds. That structure is why a takedown used to accomplish so little — the affiliates simply carried their trade to the next service, and the market reconsolidated around a new brand within months. BlackCat's collapse was different in kind: not a police action but an exit scam, the operators stealing their own affiliates' ransoms. One brand was dismantled; the other betrayed its distribution channel. Between the two, the affiliate labor market that used to rebuild a kingpin overnight didn't reassemble.
Fragmentation favors defenders: smaller groups carry less leverage, less reliable tooling, and less ability to sustain the pressure campaigns that once forced payments. The threat hasn't vanished, though: in March 2025 the FBI and CISA published a joint advisory on the Medusa variant, linked to more than 300 victims across critical infrastructure since 2021.
The backup rule grew two more digits
If one doctrine sits behind the refusal to pay, it's the backup strategy CISA has preached for years in its #StopRansomware guides: the 3-2-1 rule. Three copies of important data — production plus two backups. Two different media types, such as disk and tape. One copy off-site.
Each digit earns its place. Three copies because one backup is a single point of failure, usually discovered during the incident. Two media types because a flaw or attack that takes out one storage technology shouldn't take out the other — disk and tape fail differently, and are attacked differently. One copy off-site because fires, floods and intruders are all local events; a backup in the same building shares the building's fate. Offline because anything the network can reach, an intruder with stolen credentials can reach too. And tested — daily or weekly at minimum — because a restore that has never been rehearsed is a theory. None of this is exotic. That is rather the point.
The attackers adapted first, as usual: modern strains hunt backups before touching production data, deleting shadow copies and backup repositories before encryption starts. So the defense adapted in turn, hardening the rule into 3-2-1-1-0: three copies, two media, one off-site, plus one immutable copy, with zero errors tolerated in recovery testing.
Immutability is the digit that changed the game. It means the backup cannot be altered or deleted by anyone — not even an administrator whose credentials the attackers have stolen — until a retention period expires. Write-once-read-many (WORM) storage and S3 Object Lock provide that guarantee in the cloud. Physically air-gapped copies — tapes or disks disconnected from any network — provide it offline. And the final zero is the discipline most organizations skip. An untested backup, as backup engineers like to say, is not a backup. It is a hope.
Backups are the last line. The real goal is stopping intruders before they reach the data at all, and that's where endpoint detection and response has changed the work. Modern EDR platforms record process executions, file modifications, network connections and credential use on every endpoint, streaming telemetry to analysts or managed detection services. Ransomware follows recognizable patterns — mass file renaming, shadow-copy deletion, recovery services being disabled — and EDR rules are tuned to fire on exactly those behaviors, often killing the process before encryption. The sensor layer is moving deeper still, into the kernel itself with lightweight eBPF probes that watch every system call.
The telemetry pays off again after the alarm: when an alert fires at 2 a.m., responders can reconstruct the intrusion's full timeline from stored endpoint data — the initial phishing click, the privilege escalation, the lateral movement across servers. That visibility is what makes wipe-and-restore credible. Paired with phishing-resistant multifactor authentication, which CISA urges for all services and especially VPN and critical-system access, the combination addresses both the most common way in and the moments just before the blast.
None of this means ransomware is beaten. Attackers have shifted toward double extortion — encrypting files while stealing data, then threatening to leak it — which pressures victims even when backups are intact. The 3-2-1-1-0 rule answers the encryption. It does not answer the leak. Double extortion is best read as the market adapting to the defense. When the encryption threat lost its pricing power — because the victim could rebuild — the gangs attached a second product to the same intrusion: silence. Stolen data leaks on the attacker's schedule, and no backup restores a reputation. The doctrine didn't fail; it won its half of the fight, and the fight moved. Organizations that treat 3-2-1-1-0 as the whole answer are defending the 2023 version of the crime.
The same defensive seriousness is spreading to adjacent problems: hardware security modules are being refitted ahead of post-quantum FIPS 203 deadlines, and sensitive workloads are moving into confidential-computing enclaves that stay encrypted even while running. Fragmentation cuts both ways: smaller, less professional groups are less capable but also less predictable, harder to track. But the trend is unmistakable. Falling attacker revenue, year after year, even as attack counts climb — that's the clearest signal yet that the extortion model is under real strain, and that the unglamorous work is winning. Backups decide whether an intrusion becomes a ransom negotiation, but they do nothing about the months of quiet access that usually come first. Groups running harvest-now, decrypt-later espionage campaigns share tooling and patience with the affiliates who later sell that access to ransomware crews.
Sources
- Chainalysis — 2025 Crypto Crime Report, ransomware chapter
- Dark Reading — "Ransomware Groups Collected Less Money in 2024"
- Cointelegraph — "Ransomware losses down 35% year-over-year: Chainalysis"
- The Register — "FBI: Cybercrime cost victims 'staggering' $16.6B last year" (IC3 2024 report)
- LevelBlue — "FBI 2024 IC3 Report: Phishing Soars, Ransomware Batters Critical Infrastructure"
- Industrial Cyber — "FBI's Internet Crime Report 2024 records $16.6 billion in cybercrime losses"
- CISA — "Back Up Government Data" (3-2-1 guidance)
- U.S. Chamber of Commerce — "How to Implement the 3-2-1 Backup Rule" (3-2-1-1-0)
