Coveware combines aggregated ransomware case data, refined negotiating techniques and sound financial and operational controls to achieve superior ransomware incident response and recovery for our clients.
Understand Client Impact
Identify Ransomware
Identify Threat Actor Group
Provide Data on Threat Actor
Safe & Secure Negotiations
Transparency
Risk & Outcome Analysis
24/7/365 Coverage
100% Transparency
Payment Facilitation
Compliance Checks
Documentation & Attestation
Decryption Tools
Post Incident Documentation
Insurance Documentation
Decryption Support
“'You Can't Just Concede.' How One Expert Explains Negotiating With Cybercriminals”
Our cyber security professionals are reputable and trusted. LEARN MORE→
Are we seeing the extinction of mass data exfiltration campaigns? The stats demonstrate these attacks are losing their efficacy.
Nitrogen ransomware was derived from the previously leaked Conti 2 builder code, and is similar to Nitrogen ransomware, but a coding mistake in the ESXi malware causes it to encrypt all the files with the wrong public key, irrevocably corrupting them. This means that even the threat actor is incapable of decrypting them, and that victims that are without viable backups have no ability to recover their ESXi encrypted servers. Paying a ransom will not assist these victims, as the decryption key/ tool will not work.
Discover how Obscura ransomware corrupts encrypted files beyond recovery, and why technical validation is key to smart ransom response decisions
The percentage of companies choosing to pay ransoms dropped significantly, while threat actors shift their tactics in response to decreasing profits.
Ransomware threats are constantly evolving.
Learn more about ransomware trends through Coveware's quarterly ransomware reports. The data is collected first-hand from Coveware's Incident Response team. The report also aggregates important statistics such as ransom demands and attack vectors.
Are we seeing the extinction of mass data exfiltration campaigns? The stats demonstrate these attacks are losing their efficacy.
The percentage of companies choosing to pay ransoms dropped significantly, while threat actors shift their tactics in response to decreasing profits.
Several ransomware groups used highly targeted social engineering tactics to create a major impact across several industry sectors in Q2 2025.
The Ransomware-as-a-service (RaaS) model has not recovered from law enforcement disruption, and the entrance of novice actors along with non-Russian state-linked cybercriminals has led to uncertain outcomes for victims.
2024 was a banner year for Law enforcement agency actions against ransomware and cybercrime groups. Will the new administration ensure this momentum continues?
In Q3 2024 Law enforcement actions disrupted infrastructure and publicized the identity of several prolific ransomware threat actors
Unaffiliated ‘lone wolf’ threat actors carry out a greater share of attacks as they attempt to obfuscate their identity in Q2 2024.
RaaS developers were caught cheating their affiliates, shaking the trust in the RaaS model following several high profile law enforcement actions.
A lower percentage of ransomware victims are paying, as new regulations begin to elicit more and more public disclosure of ransomware incidents.
In Q3 2023 a series of ransomware attacks by similar threat actors created headlines and blurred the lines of attribution.
As ransomware affiliates are paid less frequently, they have adapted their strategies to compensate for the shifting dynamics of cyber extortion.
Ransomware threat actors are moving back up-market in search of lost profits as the cyber extortion economy seeks to halt its contraction.
Only 37% of ransomware victims paid a ransom in Q4, a record low as security and backup continuity investments pay off.
The conviction of a high profile security executive who paid to suppress a data leak has created a new dimension of risk for security executives.
Ransomware actors became more fluid in Q2 2022 as attribution becomes harder, and fewer victims succumb to paying cyber criminals.
Less Victims of Ransomware are Paying, even as Cybercriminals Shift from Big Game to Big Shame Hunting
Ransomware as a service groups are shifting their tactics as enterprises become harder targets, and law enforcement pressure mounts.
Ransomware attacks continued to proliferate in Q3 as governments and law enforcement ratchet up the pressure of the cyber extortion economy
Ransomware payment amounts declined in Q2 as several high profile attacks escalated the attention of the US government and law enforcement.
Ransomware attacks continued to proliferate in Q1 2021 as several common but unpatched software vulnerabilities created a fresh supply of compromised network access to ransomware affiliates.
See how doxxing victims are distributed across industries, company sizes, and revenue tiers. Find Coveware’s data and analysis on doxxing trends in Q4.
Coveware’s Q4 Ransomware Report finds that fewer companies are paying criminal extortionists that are holding stolen data for ransom.
Ransomware attacks in Q3 2020 were marked by a larger reliance on stolen data. During the quarter, Maze sunset their operations while Ryuk restarted their campaign.
During the first quarter of 2020 ransomware threat actors took advantage of the economic and workplace disruption caused by the COVID-19 outbreak. A proliferation of new variants were observed as some regular ransomware types began to fade. Read on!
During the first quarter of 2020 ransomware threat actors took advantage of the economic and workplace disruption caused by the COVID-19 outbreak. A proliferation of new variants were observed as some regular ransomware types began to fade. Read on!
Ransom demands more than doubled between Q3 and Q4 of 2019, as multiple variants gained broader distribution amongst enterprises large and small.
Coveware’s Q3 2019 report aggregates ransomware statistics such as average demands, data recovery rates, and network attack vectors.
Coveware’s Q2 2019 Ransomware Marketplace report aggregates statistics such as cyber extortion demands, ransomware data recovery rates, and network attack vectors from ransomware attacks.
Q1 2019 Ransomware Marketplace report aggregates statistics such as ransom demands, data recovery rates and attack vectors from ransomware attacks
Coveware’s Q4 Global Ransomware Marketplace Report presents aggregated data points collected from cases handled during Q4 2018 to highlight observable trends. Learn more about the latest trends in ransomware.
- Adam Wipp, Helm SMP
- Paul Grenci, CEO, Red Key Solutions
- Forrester
- Forbes
