As of April 2024, the ransomware groups Alphv and LockBit have ceded the top spot to a smaller ransomware group. A report by GuidePoint Security investigates ransomware trends as well as ransomware group activity, finding that Play has taken the top spot for April. When accounting for victim volume, the report notes that LockBit (the most prolific group for 30 out of the last 33 months) has shifted down to the fourth-most active group. On the other hand, smaller ransomware groups such as RansomHub, Dark Vault, Ra Group and Inc Ransom rank high in victim volume as well. 

When compared to preceding years, April 2024 has shown an overall decrease in total victim volume. The report notes that this is atypical, as year-over-year monthly decreases are uncommon. Typically, Q1 shows a victim volume that gradually increases. The report asserts that due to historical precedent and law enforcement disruption, the ransomware victim volume will likely stay steady or decrease in the next months.