01Threat Actor Distribution
- LockBit 3.0 accounted for 183 victims, representing 34% of total activity.
- Other followed with 66 disclosures.
- INC Ransom and INC Ransom remained consistently active.
02Geographic Distribution
- USA represented 46.2% of all tracked victims.
- Others was among the next most impacted countries.
- UK and Canada also saw notable activity.
03Industry Distribution
- Manufacturing remained the most targeted sector.
- Professional Services followed as a heavily impacted sector.
- Other and Health Care continued to be operationally critical targets.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
Others
DragonForce
BianLian
Akira
Black Basta
Qilin
8base
RansomHub
Play
INC Ransom
LockBit 3.0
USA
53
4
12
9
7
10
4
6
26
22
68
UK
9
3
1
1
3
4
9
Canada
6
1
1
2
2
1
3
2
4
Germany
7
1
1
3
7
Italy
1
2
3
1
2
1
6
Brazil
8
3
4
India
1
12
Spain
1
1
2
2
12
France
4
1
2
1
11
Belgium
2
1
1
1
2
1
1
Japan
2
4
1
1
Argentina
4
2
Czech Republic
1
1
1
1
1
Ireland
2
1
1
1
Mexico
2
3
Colombia
2
1
1
Poland
1
3
Others
23
2
3
1
1
1
9
1
37
- USA activity was heavily concentrated in LockBit 3.0.
- Some actors demonstrated narrow targeting patterns.
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
Others
LockBit 3.0
DragonForce
BianLian
Qilin
8base
RansomHub
Play
INC Ransom
Black Basta
Akira
8Base
Agriculture & Fishing
1
Mining
2
2
Utilities
1
Construction
6
9
1
1
1
5
2
2
2
Manufacturing
26
50
4
3
4
4
4
7
4
6
5
Wholesale Trade
2
5
1
2
1
2
1
Retail Trade
4
6
1
1
1
Transportation
8
6
1
1
1
1
1
1
2
Information
7
8
1
2
2
4
3
2
Finance and Insurance
9
7
1
1
2
1
Real Estate
3
3
1
1
1
Professional Services
32
28
2
7
2
3
2
6
2
5
4
Administrative
2
1
1
1
1
2
1
2
Educational Services
5
20
1
1
Health Care
7
9
2
3
1
2
9
1
Arts & Entertainment
1
1
1
1
Accommodation
1
2
1
1
Other
8
15
4
1
1
3
1
3
Public Administration
5
8
2
1
4
1
1
- Manufacturing activity was heavily concentrated in LockBit 3.0.
- Some actors demonstrated narrow targeting patterns.
06Six Month Trend Context
07Key Takeaways
- 539 ransomware disclosures were observed in May 2024.
- LockBit 3.0 led activity with 183 victims.
- USA accounted for 46.2% of disclosures.
- Manufacturing remained the most targeted industry.
08Data Methodology and Sources
- Victim counts are based on publicly disclosed ransomware leak site postings tracked during the reporting period.
- Each victim is attributed to a single threat actor based on disclosure source.
- Industry classification is assigned using standardized sector mapping.
- Country attribution is based on headquarters location where identifiable.