LockBit Attacks 2024
By |Last Updated: January 8th, 2025|32 min read|Categories: Ransomware|

Since 2020 when we started to record ransomware attacks and trends, LockBit has continually stayed on top as the most active ransomware gang when it comes to publicly disclosed ransomware attacks. Last year, LockBit attacks made the news with 83 attacks, 13% of all publicly disclosed attacks recorded.

In 2023, we began monitoring undisclosed attacks, in other words the ones that did not make the news, and found, to no surprise, that LockBit topped those lists, claiming 979 victims, representing a significant 24% of all attacks noted last year.

This notorious gang is not known for favoring big hunt targets nor does it have specific industries it likes to target, and with its continued evolution of tactics and its RaaS offering, it is clear that 2024 is set to be another busy year for LockBit.

In February, international law enforcement seized LockBit’s infrastructure and arrests were made in connection to the coordinated international operation. However, less than one week later, the ransomware group relaunched its operation and released damage control communication admitting that “personal negligence and irresponsibility” led to law enforcement disrupting its activity.

This year, we’ve decided to put a specific focus on LockBit attacks in an attempt to better track and understand their targeting and tactics. This blog will keep you up to date with all LockBit attacks, both disclosed and undisclosed, so stay tuned to find out who its next victim is.

Key: (D) = disclosed (U)= undisclosed

January

February

March

April

May

June

July

August

September

October

November

December

Our data is collated from various online sources.

Last updated 12/31/2024 at 09:59

LockBit’s 2024 Attacks – An Overview

Here’s a few stats to round up LockBit’s activities for 2024:

  • LockBit was responsible for 526 attacks – both disclosed and undisclosed
  • The notorious ransomware group held the number one spot for most active variant in 2024.
  • The group was “taken down” by Operation Cronos  in February, one week later the ransomware group relaunched its operation and released damage control communication admitting that “personal negligence and irresponsibility” led to law enforcement disrupting its activity.
  • LockBit’s Ransomware-as-a-Service product continued to facilitate news worthy attacks.
  • May was the group’s most active month, claiming 191 attacks.
  • The number of incidents slowed towards the end of the year – does this suggest LockBit’s operations are slowing down?

Share This Story, Choose Your Platform!

Related Posts

What is Data Leakage? Causes, Risks, and How to Stop it

December 27th, 2024|

Data is the most valuable asset today's businesses possess - and volumes are growing all the time. In this article we look at what data loss prevention means heading into 2025 and what should firms be doing to improve their capabilities?