Ransomware Trends Illustrated by LockBit, Akira and Others

Microsoft’s analysis explains that many human-operated ransomware attacks follow a Ransomware-as-a-Service (RaaS) model, with affiliates operating under criminal groups and varying their tactics. The report highlights four representative cases: LockBit, BlackByte, Hive and Akira.

LockBit, which emerged in 2019, has targeted a wide range of sectors including finance, healthcare and manufacturing, and is known for its ability to self-propagate within networks. BlackByte has frequently used “double extortion,” stealing data in addition to encrypting it and threatening public disclosure, and has targeted critical infrastructure such as government agencies and financial institutions.

Regarding Hive, Microsoft describes a group active from June 2021 to January 2023 that typically targeted public bodies and healthcare providers and likewise used double extortion. Microsoft emphasizes that the FBI infiltrated Hive’s network in 2022 and seized decryption keys, preventing more than $130 million in ransom demands.

Akira is described as a sophisticated malware family observed from early 2023 that affects both Windows and Linux. Attackers have used initial access methods exploiting VPN service vulnerabilities, particularly targeting environments without multi-factor authentication. Microsoft states Akira has affected about 250 organizations to date, with ransom proceeds of roughly $42 million.

The above is a summary based on Microsoft’s findings, and the background and figures for each case follow the company’s report. Details of individual incidents and the latest activity can change as law enforcement and victims disclose new information, so ongoing confirmation is necessary.