2022 Ransomware Attack Report
By |Published On: January 20th, 2023|3 min read|Categories: Ransomware, Research|

Since 2020 BlackFog has measured publicly disclosed attacks globally. The 2022 ransomware attack report reflects on the key findings from 2022. We have also published a blog discussing the key lessons learned from ransomware in 2022 which expands on the general trends we see going forward.

In 2022 we recorded a total of 376 attacks, a 29% increase over 2021 and 34% increase from 2020. Key take aways from these overall numbers is that 89% of all attacks now involve data exfiltration, 9% more than in 2021. From a tactical point of view we also saw an increase in the use of PowerShell, now at 87% of all attacks, a 7% increase from 2021. While the Dark Web was used in 23% of all attacks, a dramatic increase from 5% in 2021.

BlackFog Ransomware Report

Register to get our annual report as a PDF

2022 Ransomware Summary


From a geographic perspective, the United States dominated as in previous years, representing 46% of all attacks with an overall increase of 18% over 2021. This was followed by the UK and Canada at 7% and 6% respectively. As in 2021, 2 out of every 3 attacks were perpetrated on the top 3 countries.

In terms of data exfiltration we saw significant growth in attacks from China and Russia, representing 27% and 17% respectively. This is an 11% increase in China and 5% in Russia, these 2 countries now represent 44% of all exfiltration globally. A very sobering number indeed.

2022 Ransomware Geography


When we look at the organizational distribution in 2022 we saw some interesting trends. For the first time we saw education as the top attack target with 17% of all attacks followed closely by government and healthcare at 16% and 15% respectively. We saw the average size of organizations vary throughout the year and average 19,740 employees, on par with 2021.

A clear standout in 2022 was the significant increase in attacks on both the education and healthcare sectors, both increasing by 49% over 2021. This reflects the overall focus on sectors with the lowest investment in infrastructure and skills generally, as we have previously reported. This was following closely by government and technology with increases of 17% and 14% respectively from 2021.

2022 Ransomware Organization


The landscape on ransomware variants changed significantly during 2022 with LockBit clearly dominating successful attacks, with 16% of all attacks, followed by BlackCat at 13%, Hive at 12.1% and Conti 9.0%. Most notable is the sheer increase in attacks over 2021. LockBit was hardly even mentioned in 2021 yet saw a 600% increase in 2022. Similarly, BlackCat and Hive were virtually unheard of but they rounded out 2022 as the second and third most successful variants.

As mentioned earlier, BlackFog has also summarized the key lessons learned from 2022 and the general macro trends we are seeing that are influencing the broader market.

2022 Ransomware Variants

Share This Story, Choose Your Platform!

Related Posts

  • Crowdstrike Incident

The CrowdStrike Incident: A Global IT Meltdown

July 23rd, 2024|

Discover how the recent CrowdStrike incident caused a global IT meltdown, affecting thousands of businesses. Learn about the event timeline, its impact, and how BlackFog's advanced practices can help prevent such risks. Stay informed and protect your business from future cybersecurity threats.