In 2020 and 2021 BlackFog measured publicly disclosed attacks globally. The 2021 ransomware attack report summarizes these findings and highlights the key trends as we enter 2022.
In 2021 there were a record total of 292 reported ransomware attacks, representing an increase of 17% year over year. Of these attacks more than 80% involved data exfiltration in some form with records disclosed on the Dark Web, websites and directly to the victims. Of those, 1 out of 3 utilized Botnets and 2/3 illegal networks. We also saw 80% of ransomware utilize PowerShell to infect victims.
Geographically the United States continue to dominate these attacks with over 51%, followed by the UK with 10%, Canada 5% and France and Australia 3%. The top 3 countries represented 2 out of every 3 attacks. In addition, 1 out of every 3 attacks exfiltrated data to China or Russia (16% and 12% respectively).
At an organizational level we saw a continued trend to focus on small to medium enterprises in the last 4 months of the year, with the average size organization of 8,300 employees. In 2021 we also saw the average size of the target organization decrease by 31% to an average of 15,581 employees compared to 2020.
In 2021 we saw the biggest increase in ransomware in the retail sector with 100% growth. This was followed by an 89% increase in technology, 30% increase in healthcare, and 24% increase in government over 2020 numbers.
Ransomware continues to see new variants and 2021 was no exception. With the success of the Colonial Pipeline attack we saw REvil dominate the landscape early and finish the year with the highest number of victims, representing 17.5% of all attacks. The latter half of the year saw a massive increase in the number of attacks from Conti, which finished the year at 16.8% of all variants, and an increase of 228% over 2020. On the positive side we saw the virtual elimination of some variants such as Ryuk, Maze Nefilim and a 160% decrease in DoppelPaymer.
BlackFog has also made a number of predictions for 2022 so we shall see how these play out through the year. We are also seeing a continued increase in publicized attacks only a couple of weeks into the new year.
