In the first half of 2023, Arete observed several distinct trends and shifts in the cyber threat landscape. Leveraging the data collected during each incident response engagement, we can see the rise and fall of ransomware variants, notable trends in ransom demands and payments, industries targeted by ransomware attacks, and what may be coming next.

Looking back over the past few years, Arete has seen a pattern of action-reaction developing within cybersecurity. In response to several high-profile attacks in the past three years, many organizations invested in security tools, training, and services to reduce risk. To evade these standard security tools and common defense strategies, threat actors shifted their operations to target different types of operating systems with increasingly complex tactics.

The threat landscape continues to evolve with the widespread introduction of AI tools, lower barriers of entry into cybercrime, new vulnerabilities, and the socioeconomic effects of the Russia-Ukraine war.

Ransomware operations thriving today are pushing the envelope in development and extortion techniques. Attrition, reorganization, and re-branding within cybercriminal groups have made attribution more challenging than ever.

However, as threat actors evolve, so do the threat hunters and organizations tracking them. Global law enforcement agencies have carried out several impactful arrests and seizures on multiple high-profile cybercriminal groups in the first half of 2023. We have seen a significant increase in collaboration between law enforcement agencies and civilian cybersecurity organizations, resulting in unprecedented information sharing on indicators and tactics, allowing for more accurate attribution, restoration, and potential disruption of ransomware threat actor activities.