The U.S. Homeland Security Investigations (HSI) Cyber Crimes Center has reported significant success in combating ransomware attacks since its establishment in 2021, having disrupted over 500 cyberattacks and seized approximately $4.3 billion in extorted cryptocurrency.
According to Mike Prado, Deputy Assistant Director of HSI’s Cyber Crimes Center, government agencies have emerged as the primary targets of these attacks, accounting for 21% of the thwarted incidents—more than any other sector. In total, HSI has successfully disrupted 537 ransomware attacks and has traced vast sums of crypto on exchanges and hackers’ devices that were obtained through extortion.
Ransomware typically involves attackers encrypting a victim’s data and demanding payment in exchange for the decryption key. To counter this trend, HSI has adopted a proactive stance, constantly monitoring cybercrime activities and the evolving strategies employed by criminals. Agents analyze internet traffic for signs of malicious behavior and track software vulnerabilities that could be exploited by ransomware gangs.
Prado emphasized the goal of identifying impending attacks, sometimes even before they occur, to effectively prevent breaches. He noted that there are several groups of interest, particularly those operating outside the U.S., that are persistently seeking ways to obtain cryptocurrency.
However, this proactive strategy presents challenges. Building cases against hackers whose attacks are thwarted can be complex. When a potential attack is identified, HSI notifies relevant government agencies, businesses, and other potential victims while collaborating with agents across 235 field offices nationwide, local police departments, and federal agencies.
Ransomware Threats on the Rise
The threat of ransomware continues to escalate. According to Chainalysis’s Aug. 15 Crypto Crime Mid-Year Update, ransomware inflows have risen by 2% in 2024, totaling $459.8 million, compared to $449.1 million in 2023. Projections indicate that ransomware payments could exceed $1 billion by the end of 2023.
Moreover, the average payment size has surged dramatically—up 96% year-over-year and 335% from 2022. The median ransom payment climbed from under $200,000 in early 2023 to $1.5 million by June 2024.
Notably, Chainalysis reported in July that the largest single ransomware payment ever recorded was a staggering $75 million, paid to the group known as Dark Angels.
As ransomware tactics continue to evolve and the stakes grow higher, HSI’s ongoing efforts to disrupt these cyber threats remain critical in safeguarding U.S. organizations from potential extortion and data loss.