Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
What the ransom-chat transcripts already say about each group's real bottom line.
Based on the 138 of 214 negotiations (64.5%) whose filename carries a parseable date; years with fewer than 4 logged negotiations are omitted. Shown industry-wide, not per group — per-group yearly samples are too thin to be meaningful.
| Group | Negotiations | Paid rate | Avg. discount |
|---|---|---|---|
| Akira | 47 | 42.6% paid | 50.6% |
| Lockbit3.0 | 42 | 7.1% paid | 44.7% |
| Conti | 30 | 36.7% paid | 60.1% |
| Dragonforce | 23 | 0.0% paid | 41.3% |
| Revil | 14 | 50.0% paid | 67.5% |
| Hive | 8 | 0.0% paid | 34.2% |
| Trinity | 7 | 28.6% paid | 13.3% |
| Avaddon | 7 | 14.3% paid | 56.5% |
| Fog | 6 | 50.0% paid | 45.3% |
| Blackbasta | 5 | 80.0% paid | 39.0% |
| Darkside | 5 | 60.0% paid | 61.7% |
| Nightspire | 4 | 100.0% paid | 38.8% |
Data provided by Valéry Marchive & Julien Mousqueton