Loading story…
Ransomware operators are increasingly abandoning encryption in favor of pure data extortion, leading to a 179% surge in attacks in 2025. The convergence of financially and ideologically motivated actors, including hacktivists and state-sponsored groups, complicates attribution and defense. Organizations must adapt to these evolving tactics to effectively mitigate risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
blackfog.com
Open sourceblackfog.com
Open sourceblackfog.com
Open sourceflashpoint.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware remains one of the most significant threats to organizations worldwide, with attackers continuously evolving their tactics to maximize impact and profits. Recent analysis highlights that the most successful ransomware groups leverage automation, customization, and advanced tooling, with groups like Qilin and LockBit 5.0 leading the market by using data leak sites to pressure victims into paying ransoms. The ransomware-as-a-service (RaaS) model has further lowered the barrier to entry for cybercriminals, enabling a wider range of actors to participate in attacks. Double extortion tactics, where data is both encrypted and exfiltrated for additional leverage, are now commonplace, and the underground economy supporting ransomware is thriving, with infostealers playing a critical role in supplying credentials for initial access. Defending against ransomware requires a multi-layered approach, including the deployment of open-source platforms like Wazuh for detection and response, as well as a focus on securing credentials and monitoring for infostealer activity. The proliferation of infostealers has transformed cybercrime, enabling attackers to bypass multi-factor authentication and facilitate lateral movement within networks. Organizations are urged to improve visibility across assets, implement robust access controls, and stay vigilant against phishing and other common ransomware delivery vectors. The ongoing evolution of ransomware and its supporting ecosystem underscores the need for continuous adaptation of security strategies and technologies.
Jun 29, 2026
The ransomware landscape in 2025 experienced a significant transformation, marked by the emergence of numerous short-lived ransomware groups that rapidly executed extortion campaigns before rebranding or dissolving. Rather than relying on technical innovation, these groups focused on optimizing access through identity compromise, cloud misconfiguration, and exploiting governance gaps. Notable new families such as RansomHub, Arkana, CrazyHunter, and NightSpire appeared, often sharing infrastructure and access brokers. The proliferation of these groups led to a 20% increase in publicly listed victims compared to the previous year, with attackers increasingly leveraging weekends and holidays to maximize impact while defenders were less vigilant. Payment rates for ransomware dropped to historic lows, prompting some groups to target larger enterprises for higher payouts, while others, like Akira, focused on mid-market organizations with smaller demands. Ransomware tactics continued to evolve, with attackers adapting their procedures and expanding their use of advanced techniques, including AI-driven capabilities and targeting SaaS platforms. The operational focus shifted from malware sophistication to exploiting weaknesses in identity and cloud security. Security teams observed that attackers frequently made mistakes and adjusted their tactics in real time, as evidenced by endpoint telemetry and event logs. The overall trend in 2025 was a chaotic, fragmented threat environment where the barriers to entry for new ransomware groups were minimal, and the success of extortion operations depended more on access and agility than on technical prowess.
Jun 29, 2026
Ransomware attacks in 2025 have escalated both in volume and sophistication, with a 34%-50% increase in incidents compared to the previous year and over 4,700 confirmed attacks globally between January and September. The ransomware ecosystem has become highly fragmented following law enforcement actions against major groups like LockBit and ALPHV/BlackCat, resulting in the emergence of 45 new groups and a record 85 active extortion operations. Attackers have adopted advanced tactics such as double and triple extortion, AI-driven phishing, and exploitation of cloud and operational technology, with critical infrastructure sectors—manufacturing, healthcare, energy, transportation, and finance—bearing the brunt of these attacks. Despite the surge in attacks, ransom payment rates have dropped to historic lows, forcing threat actors to adapt their business models and extortion strategies. The operational landscape has also been shaped by shifting alliances and rebranding efforts among ransomware groups. Notably, the alleged alliance between Qilin, DragonForce, and LockBit has not led to a consolidation of power but rather continued the trend of ecosystem fragmentation. Analysis of data leak site activity post-alliance announcement shows no significant operational recovery for LockBit, despite renewed branding and the release of a new malware version. These developments underscore the resilience and adaptability of ransomware actors, as well as the ongoing challenges faced by defenders in tracking and mitigating the impact of increasingly decentralized and sophisticated ransomware operations.
Jun 29, 2026