Ransomware Attacks Show Temporary Slowing but are Expected to Increase in 2022 [Graphs]

New data from Recorded Future shows how the war in Ukraine is causing a brief slowdown of ransomware attacks on healthcare, governments and schools that is predicted to return to growing levels.

Each month, Recorded Future tracks ransomware activity, reporting on the most salient data points each month. In this month’s report, a few interesting pauses in expected attack activity occur.

First, let’s level set with the number of victim organizations whose data has been released on extortion sites:

You’ll note a slight slowdown in January and February of this year, with March showing a 50% growth over last March. So, who’s being attacked? According to Recorded Futures, it’s not Healthcare organizations:

The levels of attacks in the first quarter of this year is a material drop from the end of last year. What about governments?

Note the massive drops – again, in January and February – followed by a material increase in March. And lastly, school districts – in this case, the data shows a slight drop, but relatively steady cadence of attacks with no equivalent drops in attacks.

So, what does all this mean?

Those January and February drops, according to Recorded Future, are likely attributed to the war in Ukraine where cybercriminal gangs are taking sides and shifting efforts to aid in the cyberwar. According to Dmitry Smilyanets, ransomware expert at Recorded Future, “hacktivism and patriotic actions can’t be monetized as well as ransomware attacks. We believe the number of ransomware attacks will grow in 2022.”