Loading story…
The UK National Cyber Security Centre issued guidance urging organisations hit by ransomware to avoid panic and carefully assess alternatives before paying attackers, including restoring from backups or using available decryptors. The guidance, developed with insurance bodies ABI, BIBA, and IUA, says victims should document decisions, involve insurers, law enforcement, incident response providers, and internal technical teams, and investigate the root cause to prevent repeat compromise. It also warns that paying a ransom does not guarantee data recovery, deletion of stolen data, or compliance with legal and regulatory duties, and may be unlawful where sanctions apply.
The guidance aligns with a broader UK policy debate as officials advance plans to bar public sector bodies and critical national infrastructure operators from making ransom payments. Reporting on the debate says ransomware attacks are becoming more sophisticated, with some criminal groups using malicious AI tools such as WormGPT, FraudGPT, and BruteForceAI, while many intrusions still succeed through known vulnerabilities and weak security controls. Experts remain split on payment bans, but the reporting and official guidance both emphasize stronger resilience measures such as backups, monitoring, multi-factor authentication, and prompt reporting to authorities, including the NCSC in nationally significant cases.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
According to Fortinet's Dave Spillane, confirmed ransomware victims rose by 389% year-on-year in 2025, increasing from nearly 1,600 cases in 2024 to 7,831 worldwide in 2025. He said attackers could target four organisations in the time it previously took to conduct one attack.
Sophos' 2025 cybersecurity research found that nearly half of organisations hit by ransomware paid cybercriminals to regain access to data or systems. The finding was cited in the context of rising ransom demands and debate over payment restrictions.
The UK National Cyber Security Centre published guidance for organisations considering whether to pay a ransom during a ransomware incident. The guidance was jointly developed with ABI, BIBA, and IUA and advises victims to assess alternatives, involve relevant authorities and experts, and understand that payment does not guarantee recovery or legal compliance.
The UK government is progressing plans to prevent public sector organisations and critical national infrastructure operators from making ransomware payments. The proposed restrictions would apply to entities including the NHS, local councils, and schools.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcencsc.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking **7,551 known victims worldwide** during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than **60 new ransomware groups** entered the market, established operators including **Qilin, Everest, Cl0p, and World Leaks** remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US. The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that **nearly half of targeted companies** ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, **MFA**, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Jul 24, 2026
Reporting highlighted the **moral, legal, and operational risks of ransomware negotiation**, noting that payment brokering often occurs with limited transparency and few industry standards or accountability mechanisms. The discussion was sharpened by the case of two former incident responders—**Ryan Clifford Goldberg** and **Kevin Tyler Martin**—who pleaded guilty to participating in ransomware attacks while working in the incident response ecosystem, underscoring insider-risk and conflict-of-interest concerns in the negotiation and response market. Separate explainers reinforced that ransomware remains a high-impact, financially motivated threat: attackers commonly **encrypt systems, steal data, and threaten leaks** to increase pressure on victims, with critical services (healthcare, power, transport, finance) particularly exposed due to the cost of downtime. Executive-focused guidance emphasized shifting from “prevention-only” to **resilience**, describing a typical multi-stage playbook (initial access via phishing/exposed remote services/third parties; privilege escalation and AD compromise; lateral movement into backups and core infrastructure; exfiltration; encryption and recovery sabotage) and calling out common failure points such as weak identity governance, flat networks, and untested or accessible backups.
Jun 29, 2026
Proofpoint survey data shows that paying ransomware demands often fails to end an incident and can expose victims to further extortion. Among affected UK organizations, **58%** paid a ransom, and **22%** of those payers were targeted again; globally, **54%** of victim organizations paid and **37%** were extorted a second time. The findings reinforce long-standing warnings that attackers may continue pressuring victims even after receiving payment. The reporting also found that payment does not guarantee recovery: **2%** of victims that paid never got their files back, underscoring that criminals may withhold working decryptors or retain stolen data. Coverage cited the LockBit takedown under **Operation Cronos** as evidence that ransomware operators can keep victim information after payment, while noting that AI is increasingly improving the phishing, credential theft, impersonation, and reconnaissance activity that often precedes ransomware attacks.
Jul 23, 2026