Two prominent ransomware groups, Clop and REvil, had claimed to have shut down but there are some activities that suggest cybercriminals may have not gone completely. Clop had an unexpected return with a jump from the least active threat in March to the fourth most active in April. The so-thought-defunct REvil ransomware group claimed responsibility for a recent DDoS attack against a hospitality customer of Akamai.