Loading story…
Threat actors have shifted their data extortion tactics from exploiting technical vulnerabilities, such as SQL injection, to targeting human trust and identity through social engineering, vishing, and MFA fatigue. Groups like Scattered Spider, LAPSUS$, and ShinyHunters exemplify this evolution, leveraging identity-centric intrusions and psychological manipulation to maximize their leverage over organizations. This strategic pivot reflects a broader trend where attackers recognize that while technical defenses have improved, the human element remains a critical vulnerability.
Security professionals are urged to focus less on the branding or names of ransomware groups and more on understanding and defending against the common tactics, techniques, and procedures (TTPs) employed by these actors. The rise of the Ransomware-as-a-Service (RaaS) model and the use of affiliates has further blurred group identities, making it essential for organizations to prioritize actionable intelligence about attack methodologies over attribution. Emphasizing defense against the evolving methods of data extortion, rather than the specific actors, is key to effective risk mitigation.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators are increasingly abandoning encryption in favor of pure data extortion, leading to a 179% surge in attacks in 2025. The convergence of financially and ideologically motivated actors, including hacktivists and state-sponsored groups, complicates attribution and defense. Organizations must adapt to these evolving tactics to effectively mitigate risk.
Jun 29, 2026
**Data-extortion intrusions increased sharply last year**, with Intel 471 tracking roughly **6,800 extortion-driven attacks**—about **63% higher than 2024**—and attributing much of the growth to heightened activity from **Qilin**, **Sp1d3r Hunters**, and **Clop** operations. More than half of impacted organizations were in the **United States**, with frequent targeting of **consumer and industrial product vendors, consulting firms, and manufacturing**; Intel 471 also assessed that **initial access brokers** increasingly focused on **remote access portals** as an entry point. The same analysis noted that attackers abused a significant portion of disclosed vulnerabilities (over **40% of 520** reported bugs) and forecast that **AI** will likely *accelerate* exploitation and enable higher-ROI fraud (e.g., deepfake impersonation), even if it is not yet the primary driver of intrusions. Broader threat reporting described a **fragmenting cybercrime economy** under law-enforcement pressure, with more **new ransomware variants** derived from leaked code and a more **modular “supply chain”** of specialized services (access, laundering, negotiation) that can rapidly reconstitute after disruptions. Separate reporting highlighted how **low-tech social engineering** remains effective—such as help-desk impersonation used to reset credentials and redirect payroll—and how healthcare continues to be a favored extortion target, including the emergence of a new **“Insomnia” data-theft** brand claiming mostly US healthcare-related victims. These trends reinforce that extortion risk is being driven not only by malware families, but by **repeatable access paths** (remote access exposure, credential reuse, and service-desk process weaknesses) that enable fast monetization.
Jun 29, 2026
Enterprise ransomware operations increasingly prioritize identity compromise, lateral movement, and data theft over immediately visible encryption. In Q4 2025, attackers used legitimate administration tools including RDP, SSH, PSExec, and native management utilities for lateral movement in 65% of observed cases; confirmed data exfiltration occurred in 94% of incidents, while encryption was confirmed in 68%. Defense evasion targeted endpoint protections, identity telemetry, and logging, and credential abuse increasingly relied on reuse, replay, inherited access, and trusted relationships. Cloud and SaaS environments have further reduced defender visibility and enabled faster, quieter exfiltration. Stolen data is also becoming a durable criminal asset rather than a one-time leak: at least 10 extortion groups were reportedly analyzing, indexing, categorizing, and reselling exposed enterprise data by July 2026, using analysts, scripts, machine learning, or LLM-assisted workflows. The compromise of The Gentlemen's Rocket.Chat infrastructure exposed a structured affiliate operation targeting Fortinet VPNs, using `CVE-2024-55591`, stolen credentials, proxy-chained movement, custom G-BOT infrastructure, repurposed Velociraptor, and AI tools for negotiation and data triage. Follow-on artifacts showed `rclone`, Synology NAS, and MEGA-based exfiltration and potential Active Directory exposure, underscoring the need to revoke exposed credentials comprehensively, hunt for data-transfer tooling, harden repositories, and monitor stolen data for resale and downstream social-engineering or supply-chain abuse.
Sep 28, 2026