{
  "docId": "019dd923-5e88-73ef-bd57-cf13ce8ed1d4",
  "docSlug": "72b88f635783ce33",
  "documentTitle": "incident response insights january 2025",
  "authorId": "BoozAllenHamilton",
  "authorName": "Booz Allen",
  "documentKindSlug": "consulting-deck",
  "documentKindLabel": "Consulting deck",
  "sourceTypeSlug": "strategy_consulting",
  "sourceTypeLabel": "Strategy consulting",
  "presentationDate": null,
  "orientation": "landscape",
  "aspectRatio": 1.778,
  "pageNumber": 4,
  "pageCount": 10,
  "prevPage": 3,
  "nextPage": 5,
  "slideType": "industry_trends",
  "function": "analyze_data",
  "density": "dense",
  "nDataPoints": 120,
  "notes": "The chart uses a large color-coded legend to represent dozens of distinct threat actor groups.",
  "elementsJson": [
    "headline_text",
    "paragraph",
    "bar_chart_100pct",
    "icon_grid"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-5e88-73ef-bd57-cf13ce8ed1d4/4",
  "deckHref": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4",
  "deckJsonHref": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4.json",
  "deckAnchorHref": "/decks/019dd923-5e88-73ef-bd57-cf13ce8ed1d4#slide-4",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "In Q4 2024, we observed Akira, Blacksuit, RansomHub, Black Basta Group Akira, Play Ransomware Group, Rhysida, CLOP and Frag Threat Actor Groups dominate the Ransomware landscape.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd952-1042-7629-9bdf-ea1f80ffc326",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.65,
        "w": 0.7,
        "x": 0.25,
        "y": 0.05
      },
      "kind": "chart",
      "text": "Threat Actors 2024 YTD",
      "attrs": null,
      "subkind": "bar-stacked-100pct",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "5a6826ac-6cc8-4395-8cd1-c93fae13aee4",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.25,
        "w": 0.7,
        "x": 0.25,
        "y": 0.7
      },
      "kind": "list",
      "text": "Legend of threat actor groups",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d1f40f5a-f2b2-493a-ad81-24e571f22c6c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": null,
      "kind": "metric",
      "text": "Threat actor activity frequency",
      "attrs": null,
      "subkind": "primary",
      "toolName": "Quantification",
      "toolSlug": "quantification",
      "confidence": null,
      "componentId": "019dd952-1042-7629-9bdf-ecb8fefcd5bf",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.3,
        "w": 0.2,
        "x": 0.15,
        "y": 0.28
      },
      "kind": "paragraph",
      "text": "In Q4 2024, we observed Akira, Blacksuit, RansomHub, Black Basta Group Akira, Play Ransomware Group, Rhysida, CLOP and Frag Threat Actor Groups dominate the Ransomware landscape. Additionally, in Q4 2024, we observed a few new Threat Actor groups such as CLOP, Schrodingercat, Abyss Locker and Cactus impacting our clients.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "a76a3d7c-fb19-4882-833c-7a11e9e3f20c",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.05,
        "w": 0.2,
        "x": 0.15,
        "y": 0.18
      },
      "kind": "title",
      "text": "Threat Actor YTD Trends",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "cd4bcbca-2542-4182-ade6-fafa173a9572",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 4,
      "from": 3,
      "beatId": "eaade8c6-1657-4aff-be26-9eaef86a8739",
      "arcName": "The Sparkline",
      "arcSlug": "sparkline",
      "beatName": "Threat Actor Trends",
      "beatSlug": "sparkline-what-is-3",
      "evidence": "Slides 3-4 show industry trends and threat actor YTD trends",
      "position": 1,
      "confidence": 0.8,
      "parentBeatName": "Complication",
      "parentBeatSlug": "complication"
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}