Loading story…
Google Threat Intelligence Group and Mandiant reported that financially motivated intrusion activity is increasingly shifting away from traditional ransomware encryption toward data-theft extortion, even as ransomware remains a major enterprise threat. Google said data theft accompanied 77% of ransomware intrusions it observed in 2025, up from 57% in 2024, and noted that some ransomware-as-a-service operations now offer data-theft-only extortion options. The reporting also highlighted that English-speaking underground actors are increasingly focused on stealing data for leverage rather than deploying encryptors, with groups such as Scattered Spider, ShinyHunters, and Clop cited as examples of actors associated with large-scale extortion activity.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
On March 16, 2026, Google Threat Intelligence Group and Mandiant published a report describing the 2025 ransomware landscape, including declining profitability, lower ransom demands and payment rates, and a shift toward data extortion. The report also assessed that ransomware would remain a major threat in 2026 despite these operational changes.
Based on Mandiant incident response data from 2025, REDBIKE was the most commonly observed ransomware family, accounting for about 30% of analyzed incidents. The finding identified REDBIKE as the leading family in a year marked by broader shifts in ransomware operations.
Researchers found that ransomware actors targeted virtualization infrastructure such as VMware ESXi in about 43% of analyzed 2025 intrusions. This reflected continued attacker focus on high-impact systems that can affect many workloads at once.
In 2025, exploitation of vulnerabilities in VPNs, firewalls, and similar edge technologies was a leading initial access method in ransomware incidents. Researchers specifically highlighted frequent abuse of flaws in Fortinet, SonicWall, Palo Alto Networks, and Citrix products.
Throughout 2025, financially motivated threat actors increasingly favored data-theft-only extortion over traditional ransomware encryption, especially among English-speaking underground actors such as Scattered Spider, ShinyHunters, and Clop. Researchers found confirmed or suspected data theft in 77% of ransomware intrusions, while successful ransomware deployment fell from 54% in 2024 to 36%.
Mandiant reported that leak activity affecting Germany rose 92% in 2025, roughly triple the European average, returning pressure levels to those seen in 2022 and 2023. The report said global extortion groups including Qilin and SafePay heavily targeted German organizations, especially Mittelstand and professional services firms, amid a more volatile European leak-site ecosystem.
Across 2025, researchers observed a sharp rise in extortion-related leak site activity, with posts increasing 48% year over year to 7,784 and unique leak sites rising nearly 35% to 128. The increase reflected growing reliance on public shaming and data extortion, though researchers cautioned that some leak site claims may be false or recycled.
As prominent ransomware groups lost momentum in 2025, Qilin and Akira expanded to fill the gap in the criminal market. Their growth contributed to continued ransomware activity despite broader disruption among leading operators.
During 2025, major ransomware-as-a-service groups including LockBit, ALPHV, Basta, and RansomHub were weakened, disrupted, or dismantled by law enforcement pressure and internal conflicts. The disruption reduced the dominance of some established groups and reshaped the ransomware ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourcecybersecuritynews.com
Open sourcecyberscoop.com
Open sourcecloud.google.com
Open sourcecomputerweekly.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly abandoning file encryption in favor of **data-theft extortion**, stealing sensitive information and demanding payment to prevent its publication. A Resilience report found that **65% of extortion-related claims in H2 2025 did not involve encryption**, up from 49% in H1, while by year-end only **13%** of attacks relied on encryption alone. Insurers and researchers said stronger backup and recovery practices have reduced the leverage of traditional ransomware, making data exfiltration a faster, lower-risk path to monetization for attackers. Recent campaigns illustrate the shift. **Silent Ransom (Luna Moth)** has targeted law firms since 2023 and reportedly extracted multimillion-dollar payments from **Goodwin Procter** and **WilmerHale**, while **BlackFile/Redact** used high-volume vishing and SaaS data theft against real estate, healthcare, technology, finance, and legal organizations, with Google Threat Intelligence Group estimating it collected **more than $10 million** between February and mid-May. Researchers warned that paying for data suppression is unreliable—**30-40%** of policyholders that paid still saw data leaked, sold, or shared—and urged organizations to prioritize stopping exfiltration, protect cyber-insurance information, and rehearse extortion-response decisions through tabletop exercises.
Aug 13, 2026Ransomware operators are increasingly abandoning encryption in favor of pure data extortion, leading to a 179% surge in attacks in 2025. The convergence of financially and ideologically motivated actors, including hacktivists and state-sponsored groups, complicates attribution and defense. Organizations must adapt to these evolving tactics to effectively mitigate risk.
Jun 29, 2026
Ransomware operations are increasingly **industrialized**, shifting from simple file encryption to multi-stage extortion that combines **encryption**, **data theft/leak threats**, **DDoS**, and in some cases direct pressure on third parties such as customers, partners, or regulators. This “quadruple extortion” model has been associated with major groups including **ALPHV/BlackCat**, **CL0P**, and **LockBit**, reflecting a broader trend toward scalable, high-tempo campaigns designed to maximize coercion and revenue. At the same time, incident-response reporting indicates some **zero-day-driven, downstream mass data-theft extortion** campaigns—popularized by **CL0P** against widely used file-transfer platforms—are becoming less effective at driving payments, as organizations better understand that paying for “data suppression” does not remove notification obligations or meaningfully reduce litigation and re-extortion risk. Separately, GuidePoint assessed with high confidence that the new “**0APT**” leak site’s claimed victim list is largely **fabricated** (or recycled from other groups) and likely intended to enable opportunistic extortion, re-extortion, or affiliate fraud; organizations named by 0APT were advised to validate impact via concrete indicators (e.g., ransom note, encryption, direct communication) before treating the posting as evidence of compromise.
Jun 29, 2026