Security News > 2024 > July > Russian ransomware gangs account for 69% of all ransom proceeds
Russian-speaking threat actors accounted for at least 69% of all crypto proceeds linked to ransomware throughout the previous year, exceeding $500,000,000.
"Russian-speaking threat actors from across the former Soviet Union consistently drive most types of crypto-enabled cybercrime, from ransomware to illicit crypto exchanges and darknet markets," explains TRM. Ransomware is a form of cybercrime in which attackers steal and encrypt data on compromised systems and then demand a ransom payment in exchange for a decryption key and a promise to delete the stolen files.
New groups are filling the void, such as RansomHub, which has quickly grown to become one of the most active ransomware gangs.
TRM says LockBit and ALPHV alone collected cryptocurrency ransom payments of at least $320,000,000 during 2023, while all Russian ransomware proceeds surpassed $500 million.
In 2023, the three largest Russian dark web markets handled $1.4 billion in transactions, whereas the Western markets reached a total of $100 million over the same period.
"At least some of this volume represents cryptocurrency sent by Russian-speaking actors to sanctioned Chinese manufacturers to purchase military equipment and critical components used by Russian forces in Ukraine," explains TRM in the report.