
In 2020 and 2021 BlackFog measured publicly disclosed attacks globally. The 2021 ransomware attack report summarizes these findings and highlights the key trends as we enter 2022.
In 2021 there were a record total of 292 reported ransomware attacks, representing an increase of 17% year over year. Of these attacks more than 80% involved data exfiltration in some form with records disclosed on the Dark Web, websites and directly to the victims. Of those, 1 out of 3 utilized Botnets and 2/3 illegal networks. We also saw 80% of ransomware utilize PowerShell to infect victims.

Geographically the United States continue to dominate these attacks with over 51%, followed by the UK with 10%, Canada 5% and France and Australia 3%. The top 3 countries represented 2 out of every 3 attacks. In addition, 1 out of every 3 attacks exfiltrated data to China or Russia (16% and 12% respectively).

At an organizational level we saw a continued trend to focus on small to medium enterprises in the last 4 months of the year, with the average size organization of 8,300 employees. In 2021 we also saw the average size of the target organization decrease by 31% to an average of 15,581 employees compared to 2020.
In 2021 we saw the biggest increase in ransomware in the retail sector with 100% growth. This was followed by an 89% increase in technology, 30% increase in healthcare, and 24% increase in government over 2020 numbers.

Ransomware continues to see new variants and 2021 was no exception. With the success of the Colonial Pipeline attack we saw REvil dominate the landscape early and finish the year with the highest number of victims, representing 17.5% of all attacks. The latter half of the year saw a massive increase in the number of attacks from Conti, which finished the year at 16.8% of all variants, and an increase of 228% over 2020. On the positive side we saw the virtual elimination of some variants such as Ryuk, Maze Nefilim and a 160% decrease in DoppelPaymer.

BlackFog has also made a number of predictions for 2022 so we shall see how these play out through the year. We are also seeing a continued increase in publicized attacks only a couple of weeks into the new year.
Related Posts
The State of Ransomware 2025
BlackFog's state of ransomware report 2025 measures publicly disclosed and non-disclosed attacks globally.
Iran Hacked Trump Campaign: A Deep Dive into the Cyberattack
An overview of how Iranian IRGC hackers penetrated Trump's campaign through spear-phishing, leaked sensitive data to influence opponents, and the DOJ's subsequent response.
Microsegmentation: Strengthening Network Security Against Zero Day Exploits
Find out why microsegmentation is an increasingly popular option for supporting zero trust networking approaches.
Patch Management: An Essential Part of Data Security
Ensuring you have a strong patch management strategy in place is essential in minimizing the risks posed by known vulnerabilities.
Layered Security – How a Defense-in-Depth Approach Guards Against Unknown Threats
Make sure your systems are fully protected from threats at every level by incorporating these six key layered security defense strategies.
Zero Trust Data Protection: Securing Your Data in a Perimeterless World
What should firms know about zero trust data protection and how can they ensure it is implemented effectively?