Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
What the ransom-chat transcripts already say about each group's real bottom line.
Based on the 192 of 278 negotiations (69.1%) whose filename carries a parseable date; years with fewer than 4 logged negotiations are omitted. Shown industry-wide, not per group — per-group yearly samples are too thin to be meaningful.
| Group | Negotiations | Paid rate | Avg. discount |
|---|---|---|---|
| Akira | 75 | 36.0% paid | 52.6% |
| Lockbit3.0 | 45 | 6.7% paid | 44.7% |
| Conti | 32 | 34.4% paid | 60.1% |
| Dragonforce | 23 | 0.0% paid | 41.3% |
| Revil | 20 | 45.0% paid | 65.8% |
| Trinity | 14 | 21.4% paid | 56.7% |
| Nightspire | 11 | 90.9% paid | 35.7% |
| Hive | 8 | 0.0% paid | 34.2% |
| Avaddon | 7 | 14.3% paid | 56.5% |
| Fog | 6 | 50.0% paid | 45.3% |
| Blackbasta | 5 | 80.0% paid | 39.0% |
| Darkside | 5 | 60.0% paid | 61.7% |
Data provided by Valéry Marchive & Julien Mousqueton