Loading story…
Proofpoint survey data shows that paying ransomware demands often fails to end an incident and can expose victims to further extortion. Among affected UK organizations, 58% paid a ransom, and 22% of those payers were targeted again; globally, 54% of victim organizations paid and 37% were extorted a second time. The findings reinforce long-standing warnings that attackers may continue pressuring victims even after receiving payment.
The reporting also found that payment does not guarantee recovery: 2% of victims that paid never got their files back, underscoring that criminals may withhold working decryptors or retain stolen data. Coverage cited the LockBit takedown under Operation Cronos as evidence that ransomware operators can keep victim information after payment, while noting that AI is increasingly improving the phishing, credential theft, impersonation, and reconnaissance activity that often precedes ransomware attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Proofpoint survey findings reported that many ransomware victims who paid were targeted again for additional extortion, including 22 percent of UK payers and 37 percent of payers globally. The survey also found that some victims who paid still did not recover their files, underscoring that payment does not guarantee resolution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceitpro.com
Open sourcemalware.news
Open sourcetheregister.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent study presented at Black Hat Europe analyzed data seized from the LockBit ransomware group, revealing that organizations who pay ransoms to avoid publicity often experience greater media exposure than those who refuse to pay. Max Smeets, co-director of Virtual Routes, examined the largest 100 payouts to LockBit and compared them to 100 random cases where victims did not pay, using data provided by the UK's National Crime Agency following Operation Cronos, which disrupted LockBit's infrastructure. The findings indicate that succumbing to extortion does not reduce, and may even increase, unwanted attention for victim organizations. The research challenges the common belief that paying ransomware demands can help organizations avoid reputational damage. Instead, the analysis suggests that payment may attract more media coverage, potentially due to increased interest in high-profile payouts or leaks by threat actors. The study underscores the importance of considering the broader consequences of ransom payments and highlights the ongoing risks posed by ransomware groups like LockBit, even after law enforcement interventions.
Jun 29, 2026
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026
Ransomware groups are experiencing a significant decline in payment rates, with only 23% of victims paying ransoms in Q3 2025, according to Coveware. This trend is attributed to organizations implementing stronger defenses, increased law enforcement pressure, and a growing understanding that paying to suppress stolen data offers little benefit. The average and median ransom payments have also dropped, with figures reaching $377,000 and $140,000, respectively. Ransomware-as-a-Service groups like Akira and Qilin are adapting by targeting different market segments, but even high-profile data exfiltration campaigns have yielded limited returns for attackers. As payments decrease, ransomware actors are shifting their tactics, focusing more on data exfiltration—now the primary objective in over 76% of observed attacks—and exploring new methods of initial access. Notably, there has been a rise in insider threats, with attackers bribing employees for credentials or remote access, and an evolution in helpdesk social engineering techniques. These changes reflect a more targeted and inventive approach by threat actors as they seek to overcome improved organizational defenses and maximize their chances of financial gain.
Jun 29, 2026