NCC Group saw a record 502 ransomware attacks in July, up from 198 in July 2022; the Cl0p ransomware-as-a-service gang was tied to 171 of the July 2023 attacks
Ransomware attacks reached record levels in July 2023, driven by the Cl0p ransomware group's exploitation of MOVEit software.
Context & Ripple Effects
The July spike follows an earlier March ransomware surge tied to GoAnywhere MFT exploits, indicating that compromises of managed file-transfer software were already producing unusually concentrated attack activity.
Cl0p had begun naming organizations targeted through MOVEit in June, and subsequent analysis tracked the breach campaign across 122 organizations and roughly 15 million people in the MOVEit zero-day fallout. The July tally shows how that campaign translated into the broader ransomware count.
First-order effects
- Organizations exposed through MOVEit face immediate data-extortion and incident-response pressure as Cl0p accounts for a large share of July’s recorded attacks.
- NCC Group’s figures make the MOVEit campaign the central explanation for July’s record volume, rather than a diffuse rise across unrelated ransomware groups.
Second-order effects
- Security teams and managed file-transfer vendors are pushed to prioritize vulnerability remediation, exposure review and third-party access checks; the earlier release of initial MOVEit victims raises the stakes for organizations still assessing exposure.
- A single exploited platform can distort monthly ransomware metrics, forcing risk teams and insurers to distinguish campaign-driven spikes from a broad change in attacker capacity.
Third-order effects
- If repeated across enterprise software categories, mass exploitation of shared infrastructure will make software-supply and third-party exposure a more important driver of ransomware risk than organization-by-organization targeting alone.
- The pattern favors ransomware operations that can pair a broadly exploitable flaw with data theft and extortion, concentrating losses across many victims even when a campaign has one technical entry point.
The trend: Ransomware is becoming increasingly shaped by high-scale exploitation of shared enterprise software, with a single vulnerability capable of generating a disproportionate share of attacks.