Ransomware Victims Are Paying Hackers Less Often

According to statistics from Coveware, the total amounts paid to ransomware operators have been decreasing since the last quarter of 2021. In the second quarter of 2022, the average ransom payment was $228,125 (an 8% increase compared to the first quarter of 2022). However, the median ransom payment was only $36,360, which is 51% less than the previous quarter.

Analysts note that this downward trend began at the end of last year, when both the average ($332,168) and median ($117,116) ransom payments peaked.

Ransom Payment Trends

Researchers explain that RaaS (Ransomware-as-a-Service) operators and developers are increasingly targeting mid-sized companies and organizations, as these attacks carry less risk. Experts also point to an “encouraging trend” where large companies simply refuse to negotiate with criminals if the ransom demands are unreasonably high.

According to Coveware, the average size of victimized companies decreased even further this quarter, as hackers are now seeking out smaller but financially stable organizations for their operations.

Victim Company Sizes and Attack Methods

Analysts emphasize that in many cases, attackers continue their extortion or publish stolen company files even after receiving a ransom payment. In many incidents, data theft was the main method of extortion, meaning that not all cases involved file encryption. As a result, the average downtime caused by ransomware attacks dropped to 24 days, which is 8% less than in the first quarter of 2022.

The most active ransomware group in the second quarter was BlackCat (also known as ALPHV), responsible for 16.9% of all known attacks, followed by LockBit, which accounted for 13.1% of incidents.

New Trends in Ransomware Operations

Another new trend is the emergence of numerous small RaaS operations, where criminals recruit “partners” from recently disbanded syndicates to carry out lower-level opportunistic attacks.