Loading story…
Ransomware groups are increasingly timing their attacks to coincide with weekends and holidays, exploiting periods when organizations have reduced Security Operations Center (SOC) staffing and slower response times. According to a Semperis report, over half of ransomware incidents in the past year occurred during these off-hours, with 78% of organizations cutting SOC coverage by at least half and 6% leaving their SOCs completely unstaffed outside the regular workweek. This strategic timing allows threat actors to penetrate deeper into networks before detection, leading to longer investigations, higher financial losses, and significant business disruptions. The trend is consistent across regions and sectors, and is exacerbated by internal events such as mergers, acquisitions, and restructurings, which introduce vulnerabilities in identity systems that attackers are quick to exploit.
The persistent threat of ransomware during these vulnerable periods is compounded by the challenge of maintaining work-life balance for cybersecurity professionals, with many reporting missed holidays and increased burnout. Automated alerting and outsourced monitoring are cited as partial mitigations, but the consensus among experts is that vigilance must be maintained even during off-hours. The "assume breach" mindset is gaining traction, as organizations recognize that attackers are patient and opportunistic, leveraging any lapse in coverage to maximize impact. The financial and operational consequences of delayed response underscore the need for robust crisis management frameworks and continuous monitoring, especially during times when internal resources are stretched thin.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting amplified the report's findings and recommended measures such as automation, network segregation, tabletop exercises, incident response documentation, and on-call rotations to reduce risk during holidays and other low-staffed periods. The coverage emphasized that AI and automation can help but do not replace maintaining baseline human security coverage.
The same Semperis report found that 60% of ransomware incidents followed organizational change such as mergers, acquisitions, or restructuring, with M&A identified as the most common trigger. It also highlighted gaps in identity remediation and recovery preparedness that can prolong downtime after attacks.
A Semperis report found that more than half of organizations that experienced ransomware in the past year were attacked during weekends, holidays, or other off-hours, when SOC staffing and investigative capacity are typically reduced. The report also said many organizations cut SOC coverage significantly during these periods, increasing attacker dwell time before detection.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware attacks have surged in frequency and sophistication, with organizations facing a dramatic increase in incidents driven by AI-powered attack chains, double- and multi-extortion tactics, and the proliferation of ransomware-as-a-service. Industry surveys and reports highlight that nearly 78% of companies experienced ransomware attacks in the past year, with attack volumes tripling year-over-year and public disclosures rising sharply. Attackers are increasingly leveraging artificial intelligence to accelerate intrusion, encryption, and extortion, rendering traditional detection methods less effective. The financial impact is severe, with average incident costs exceeding $5 million and a significant portion of victims suffering major disruption or data loss, even when ransoms are paid. Security leaders emphasize the urgent need for comprehensive ransomware playbooks, regular tabletop exercises, and enhanced training to build organizational resilience. Despite the growing threat, many organizations remain underprepared, with 76% struggling to keep pace with AI-assisted attacks and 85% acknowledging the obsolescence of legacy detection tools. Experts recommend a shift from reactive to proactive defense, including robust planning, cloud data protection, and continuous improvement of incident response capabilities to mitigate the evolving ransomware landscape.
Jun 29, 2026
Ransomware attacks have reached unprecedented levels globally, with the third quarter of 2025 witnessing a 36% year-over-year increase in publicly disclosed incidents, according to BlackFog’s latest report. The total number of ransomware attacks reported in this period climbed to 270, marking a 335% rise since Q3 2020. These attacks have caused significant operational disruptions across various sectors, including airlines, automotive manufacturers, governments, and organizations in 93 countries. Notable incidents include grounded aircraft, stranded passengers, and manufacturers such as Jaguar Land Rover being forced to halt production, with some operations only recently resuming after prolonged outages. The impact of ransomware extends beyond large enterprises, severely affecting small businesses that often lack the resources and security infrastructure to defend against such threats. Many small business owners have reported devastating financial consequences, with some losing nearly all their savings and seeing their businesses shrink dramatically. The attack on the UK nursery chain Kido in September 2025 highlighted the evolving tactics of ransomware groups, as sensitive data on children, parents, and carers was exfiltrated, raising concerns about the targeting of vulnerable sectors. Ransomware operators are increasingly indiscriminate, targeting organizations of all sizes and types, and seeking leverage through data theft and extortion. The psychological and financial toll on victims is profound, with individuals and organizations facing long-term recovery challenges. Research indicates that small businesses are particularly vulnerable, often lacking dedicated IT security staff, legal support, or sufficient cash reserves to weather the aftermath of an attack. The stress and adversity experienced by victims underscore the need for robust data protection and incident response strategies. Experts emphasize that the best defense is to make it as difficult as possible for cybercriminals to succeed, focusing on data protection to reduce the incentive for extortion. The continued upward trend in ransomware volumes signals an urgent need for organizations to reassess their security postures and invest in preventive measures. The widespread and lasting impact of these attacks demonstrates that ransomware remains one of the most significant threats to global business continuity and data security. Organizations are urged to prioritize anti-data exfiltration technologies and comprehensive incident response planning. The evolving threat landscape requires constant vigilance and adaptation to new attacker tactics. The experiences of both large enterprises and small businesses illustrate the far-reaching consequences of ransomware, from operational shutdowns to personal financial ruin. As attackers become more aggressive and sophisticated, the imperative for proactive defense and resilience has never been greater.
Jun 29, 2026
Ransomware attacks continue to pose a significant threat to organizations, with recent surveys indicating that paying the ransom does not guarantee successful data recovery. According to Hiscox’s Cyber Readiness Report, only 60% of companies that paid a ransom were able to recover all or part of their data, while 40% lost their data despite payment. The technical sophistication of ransomware operators varies, with established groups more likely to provide functional decryptors, but many victims still face flawed encryption or unresponsive attackers. Additionally, the frequency of ransomware incidents has surged, with reports showing a near tripling of cases year-over-year in early 2025, and a majority of victims experiencing data theft even after paying ransoms. The ransomware landscape has evolved from high-volume, opportunistic attacks to a "big game hunting" model, where adversaries selectively target organizations with the most to lose and the greatest ability to pay. New criminal syndicates such as Spoiled Scorpius (RansomHub) and Howling Scorpius (Akira) are conducting sophisticated, long-term campaigns against high-value targets, often employing multi-extortion tactics that combine data encryption with threats of public exposure. This strategic shift has transformed ransomware from a purely IT issue into a critical business continuity threat, requiring organizations to adopt new defensive strategies and prepare for more calculated, high-impact attacks.
Jun 29, 2026