Of all the malware cases, 28% involved ransomware, followed by backdoors and webshells, at 20% and 13% respectively.

Ransomware comprises nearly one-third (28%) of malware incident response cases and 11% of security cases.

15% of smaller middle market organisations reported at least one ransomware attack or request.

28% of respondents at middle market organisations said their existing security measures were partially successful against ransomware attacks.

Extortion following a ransom demand occurred in 12% of cases.

Among middle market companies that experienced at least one ransomware attack, 31% said existing security measures were unsuccessful.

Analysis of dark web data reveals a 25% increase in ransomware activity year-over-year.

Manufacturing had the highest number of ransomware cases in 2024.

Use of remote ransomware increased 50 percent in 2024 over last year.

Ransomware cases accounted for over 90 percent of Sophos Incident Response cases for midsized organisations (from 500 to 5000 employees) in 2024.

EDRSandBlast variants were detected in waves of attempted ransomware attacks throughout 2024, including a dramatic peak around the US Thanksgiving holiday in November

Ransomware cases accounted for 70 percent of Sophos Incident Response cases for small business customers in 2024.

Most active STAC campaigns tracked by Sophos MDR in 2024 were ransomware-related.

Use of remote ransomware increased 141 percent since 2022.

The use of remote ransomware increased 50 percent in 2024 over last year, and 141 percent since 2022.

The average price of "junk gun" ransomware obtained from an underground marketplace is $375.

Ransomware and data theft attempts accounted for nearly 30 percent of all Sophos Managed Detection and Response (MDR) tracked incidents (in which malicious activity of any sort was detected) for small and midsized businesses.

The average response time to ransomware attacks is 6.71 hours among financial institutions. Last year's average response time to ransomware attacks was 6.62 hours.

The average ransom paid dropped 33% in 2024 to $501,388, down from $747,651 in 2023.

54% of ransom-paying victims recovered their data—down from 73% two years ago.