TZUTC: -0500
MSGID: 1817.consprcy@1:2320/105 2d9ebd0e
PID: Synchronet 3.21a-Linux master/123f2d28a Jul 12 2025 GCC 12.2.0
TID: SBBSecho 3.28-Linux master/123f2d28a Jul 12 2025 GCC 12.2.0
BBSID: CAPCITY2
CHRS: ASCII 1
FORMAT: flowed
US Treasury offers cautious optimism as ransomware payments decline

Date:
Tue, 09 Dec 2025 16:30:00 +0000

Description:
The takedown of major players left a visible dent but is it too early to
celebrate?

FULL STORY

The takedown of ALPHV and LockBit ransomware gangs made a solid dent in the
overall performance of ransomware operations last year. 

This is according to the Treasury Departments Financial Crimes Enforcement
Network (FinCEN) which recently said that after all-time highs in 2023, the
number of ransomware infections and paid ransoms declined in 2024. 

In its Financial Trend Analysis paper, it confirmed that between 2013 and
2021, there were 3,075 reported cases of ransomware infections, with victims
paying $2.4 billion in ransom demands. 

Three key players out of the picture

Between January 2021 and December 2024, there were 4,194 such attacks, and
$2.1 billion in payments. 2023 was peak year. That year, around $1.1 billion
exchanged hands, which was a 77% increase compared to the year before. Some 
of the most active groups at the time were ALPHV (AKA BlackCat), Akira,
LockBit, Black Basta, and Phobos. 

Thats when law enforcement stepped in. Both ALPHV and LockBit were taken 
down, while Black Basta imploded after internal communications leaked. As a
result, there were just 1,476 incidents in 2024 (down from 1,512 the year
prior) and about $734 million in payments. 

The median ransomware payment in 2023 was $174,000, significantly more than
the $124,097 in 2022 and $155,257 in 2024. 

The three groups that collapsed - ALPHV, LockBit, and Black Basta, raked in
almost $790 million between them, during the analyzed time period. Akira,
which is active today, was responsible for the largest number of attacks
(376), while ALPHV and LockBit each had around 353. Financial services firms,
manufacturing companies and the healthcare industry were the most targeted
sectors. 

Almost all of the payments (97%) were made in Bitcoin, which the gangs sent 
to unregulated cryptocurrency exchanges and tumbling/mixing services to
launder. 

 Via The Record 

======================================================================
Link to news story:
https://www.techradar.com/pro/security/us-treasury-offers-cautious-optimism-as
-ransomware-payments-decline

$$
--- SBBSecho 3.28-Linux
 * Origin: capitolcityonline.net * Telnet/SSH:2022/HTTP (1:2320/105)
SEEN-BY: 105/81 106/201 128/187 129/14 305 153/7715 154/110 218/700
SEEN-BY: 226/30 227/114 229/110 134 206 300 307 317 400 426 428 470
SEEN-BY: 229/664 700 705 266/512 291/111 320/219 322/757 342/200 396/45
SEEN-BY: 460/58 633/280 712/848 902/26 2320/0 105 304 3634/12 5075/35
PATH: 2320/105 229/426