Loading story…
A recent study presented at Black Hat Europe analyzed data seized from the LockBit ransomware group, revealing that organizations who pay ransoms to avoid publicity often experience greater media exposure than those who refuse to pay. Max Smeets, co-director of Virtual Routes, examined the largest 100 payouts to LockBit and compared them to 100 random cases where victims did not pay, using data provided by the UK's National Crime Agency following Operation Cronos, which disrupted LockBit's infrastructure. The findings indicate that succumbing to extortion does not reduce, and may even increase, unwanted attention for victim organizations.
The research challenges the common belief that paying ransomware demands can help organizations avoid reputational damage. Instead, the analysis suggests that payment may attract more media coverage, potentially due to increased interest in high-profile payouts or leaks by threat actors. The study underscores the importance of considering the broader consequences of ransom payments and highlights the ongoing risks posed by ransomware groups like LockBit, even after law enforcement interventions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
At Black Hat Europe 2025, Max Smeets presented research based on UK National Crime Agency data showing that LockBit victims who paid were more likely to receive media coverage than those who refused. The study argued that paying for secrecy often fails and can worsen reputational exposure.
Analysis of data seized during Operation Cronos showed that after the 2024 law enforcement action, fewer LockBit affiliates received payments and successful extortions dropped sharply. Researchers and officials concluded the group was no longer a major threat at its previous scale.
Following the 2024 disruption, law enforcement publicly identified Dmitry Yuryevich Khoroshev as the person behind the LockBitSupp alias. The attribution was part of broader efforts to weaken the group's credibility and operations.
In 2024, coordinated law enforcement action under Operation Cronos infiltrated LockBit's infrastructure and disrupted the group's operations. Authorities also recovered stolen data and used LockBit's own leak site to undermine affiliate trust.
Research presented at Black Hat Europe 2025 found that LockBit had 194 affiliates active between 2022 and 2024, with 80 of them successfully receiving ransom payments. The data illustrated the scale of LockBit's ransomware-as-a-service model before its disruption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
computerweekly.com
Open sourcewelivesecurity.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint survey data shows that paying ransomware demands often fails to end an incident and can expose victims to further extortion. Among affected UK organizations, **58%** paid a ransom, and **22%** of those payers were targeted again; globally, **54%** of victim organizations paid and **37%** were extorted a second time. The findings reinforce long-standing warnings that attackers may continue pressuring victims even after receiving payment. The reporting also found that payment does not guarantee recovery: **2%** of victims that paid never got their files back, underscoring that criminals may withhold working decryptors or retain stolen data. Coverage cited the LockBit takedown under **Operation Cronos** as evidence that ransomware operators can keep victim information after payment, while noting that AI is increasingly improving the phishing, credential theft, impersonation, and reconnaissance activity that often precedes ransomware attacks.
Jul 23, 2026
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026