March 2023 was a crowded month for incident response teams. Both the Cyber Management Alliance's running incident tracker and a Black Kite ransomware report covered by the Jerusalem Post point to a sustained, broad wave of attacks across retail, finance, manufacturing, and consumer services.
Two threads run through the noise: ransomware crews are not slowing down, and the supply chain keeps leaking credentials and data at scale.
Quick take
- Black Kite counted 410 ransomware victims in March 2023, versus 208 in April 2022.
- LockBit was the most active group, tied to 29% of attacks in the analysed period.
- Hatch Bank lost records for about 140,000 customers through its Fortra GoAnywhere MFT appliance, and Cl0p is the prime suspect.
- WH Smith confirmed a breach of current and former employee data.
- BidenCash posted 2,165,700 stolen card numbers for free to celebrate its first anniversary.
- A campaign called Hiatus is quietly compromising DrayTek Vigor 2960 and 3900 routers.
The big picture from Black Kite
Black Kite's first annual Ransomware Threat Landscape Report reviewed 2,708 incidents between April 2022 and March 2023. The standout number: 410 reported victims in March 2023 alone, roughly 1.6 times the worst month of 2022. Manufacturing topped the targeted-sector list, followed by professional, scientific and technical services. The United States accounted for 43% of victim organisations, with the UK next at 5.7% and Germany at 4.4%.
On the actor side, one group ran away with the chart. LockBit accounted for 29% of attacks, followed by AlphaVM, better known as BlackCat, at 8.6%, and Black Basta at 7.2%. BlackCat is worth flagging on its own: Black Kite says 55% of its victims sit in the US, but the group has hit organisations across 44 countries.
The GoAnywhere fallout keeps rolling
The Hatch Bank incident is one of the more visible entries in the wider Fortra GoAnywhere MFT exploitation wave that started earlier in 2023. Hatch publicly acknowledged that customer records, numbering close to 140,000 individuals, were siphoned from its GoAnywhere environment. Cl0p remains the most likely operator, the same crew that hit dozens of other organisations running the same file transfer product.
If your environment still hosts GoAnywhere and you have not validated the patch state, this week is the right week to act. The actor is opportunistic, well-resourced, and patient.
Other notable incidents
WH Smith confirmed a breach of current and former employee data, though the entry vector has not been publicly detailed. Chick-fil-A disclosed a credential-stuffing wave that hit customer accounts between mid-December 2022 and mid-February 2023. The Sandbox, a blockchain gaming platform, was turned into a phishing launchpad after an employee's mailbox was compromised, with malicious emails sent to users containing links to off-site malware.
Then there is the BidenCash dump. The marketplace released 2,165,700 stolen card numbers for free to mark its first anniversary. Free dumps of this size are usually a marketing exercise, but they hand working card data to less-skilled fraudsters, which is exactly how a stolen card becomes a chargeback problem at your help desk.
Finally, the Hiatus router campaign targeting DrayTek Vigor 2960 and 3900 models is the kind of slow-burn threat defenders tend to miss. The malware is built for quiet data theft and to recruit the device into a covert proxy network. If you run those models in production, treat them as exposed until you have evidence otherwise.
Our analysis
The LockBit number is the story. 29% market share, by victim count, for one ransomware group over a full year is industrial scale. That is not a gang; that is a business with a sales pipeline.
The other story is the spread. Manufacturing is now the most-targeted vertical, which lines up with the broader trend of ransomware crews chasing downtime-heavy businesses that run older stacks and tight margins. If you are a CISO in that sector, you are in the crosshairs by sector, not by chance.
The Hiatus router campaign is the quiet one to worry about. Compromised edge devices give attackers a long-term foothold inside the perimeter that does not surface in normal EDR data. If your edge estate is invisible to your vulnerability programme, you are trusting the manufacturer's default posture, and that is a bet you should not be making in 2023.
Say you are a CISO at a mid-sized US manufacturer
A LockBit affiliate is probably already probing your environment. The questions that matter are blunt: does your identity provider enforce phishing-resistant MFA on every account, are your backups immutable and isolated from your domain identities, and is your EDR catching the early-stage behaviours such as LSASS dumping, scheduled task creation, and lateral movement to file servers. If you cannot answer "yes" to all three, you are paying the ransom in 2024, not negotiating it.
What to watch next
Watch for more GoAnywhere MFT fallout from Cl0p, more LockBit rebrand activity under continued law enforcement pressure, and more router-level malware. Edge devices are the next big battleground, and most vulnerability management programmes still do not cover them.
Key takeaways
- March 2023 produced 410 ransomware victims, the worst month in Black Kite's dataset.
- LockBit, BlackCat and Black Basta dominate the ransomware landscape.
- Routers, file transfer software and third-party SaaS are the soft underbelly of the modern enterprise.
Frequently asked questions
Which ransomware group was most active in early 2023?
LockBit, tied to 29% of attacks analysed in Black Kite's report covering April 2022 to March 2023, followed by BlackCat and Black Basta.
What is the Hatch Bank breach about?
Hatch Bank disclosed that personal information for around 140,000 customers was stolen via its Fortra GoAnywhere MFT appliance, with Cl0p the likely operator.
What is the Hiatus router campaign?
An ongoing campaign targeting DrayTek Vigor 2960 and 3900 routers to steal data and enrol the devices into a hidden proxy network.
Why is the BidenCash card dump notable?
BidenCash posted over 2.16 million stolen card numbers for free, putting them in the hands of low-skill fraudsters and typically triggering a wave of card-testing and chargeback fraud.
Sources: cm-alliance.com, jpost.com