Fast Facts
- Ransomware profits declined sharply in 2025, with lower payment rates, demands, and higher victim recoveries, yet threat actors are evolving their tactics to make operations harder to disrupt.
- The ransomware ecosystem experienced major disruptions, with key groups like LockBit and ALPHV weakened or dismantled, while new actors like Qilin and Akira increased activity and victim postings surged.
- Data exfiltration became dominant in 2025, confirmed or suspected in 77% of cases, with attackers stealing sensitive data before encryption to pressure victims into paying extortion demands.
- Threat actors increasingly targeted smaller organizations and used common tools like Rclone and WinRAR for data theft, prompting organizations to strengthen data loss prevention and monitor for exfiltration activity.
The Issue
In 2025, the ransomware landscape experienced a significant shift, marked by declining profits and increased sophistication among threat actors. Reports from CoveWare and Sophos reveal that ransom payments hit historic lows, with demands dropping by a third and only 11% of victims restoring their data from backups—an indicator that victims are regaining their resilience. However, despite these economic setbacks, ransomware groups persist, adapting their tactics to avoid disruption; notably, the ransomware family REDBIKE surpassed previous leaders like LOCKBIT and ALPHV, accounting for nearly 30% of incidents. These groups, including newly emerging ones like Qilin and Akira, have exploited law enforcement pressure on established operations, leading to a rise in attacks on smaller organizations less equipped to defend against threats. Moreover, threat actors increasingly rely on data theft as a primary extortion tool—confirmed or suspected in about 77% of incidents—stealing sensitive files before encryption to pressure victims into compliance, often using tools like Rclone and WinRAR to exfiltrate data. Consequently, security experts emphasize the importance of robust data loss prevention measures and continuous monitoring to mitigate these evolving threats, highlighting a perilous new phase in ransomware tactics driven by economic pressures and strategic adaptation.
What’s at Stake?
The issue titled ‘Google Warns Ransomware Actors Are Shifting Tactics as Profits Fall and Data Theft Rises’ could profoundly impact your business because cybercriminals are adapting their strategies in response to changing financial incentives. As ransomware profits decline, attackers are increasingly turning to data theft, which can lead to stolen sensitive information, damage to reputation, and legal repercussions. This shift means that even if you have strong defenses against traditional ransomware, your business remains vulnerable to data breaches and extortion. Additionally, cybercriminals may employ more sophisticated tactics, making attacks harder to detect and prevent. As a result, it’s crucial for businesses to recognize these evolving threats, strengthen cybersecurity measures, and be prepared for new types of attacks that can cause operational disruptions, financial loss, and long-term damage.
Possible Actions
In an evolving cybersecurity landscape, swift remediation is crucial to prevent ransomware threats from escalating, especially as malicious actors adapt their tactics to capitalize on shifting profit models and increased data theft. Rapid response not only limits the damage but also disrupts attacker operations, safeguarding organizational assets and maintaining stakeholder trust.
Detection & Analysis
- Implement continuous monitoring mechanisms to quickly identify unusual activities.
- Conduct thorough incident analyses to understand attack vectors and scope.
Containment & Eradication
- Isolate affected systems immediately to prevent lateral movement.
- Remove malicious files and close vulnerabilities exploited by attackers.
Recovery
- Restore data from backups verified as clean and current.
- Verify system integrity before bringing operations back online.
Communication & Reporting
- Notify relevant stakeholders and authorities in line with legal requirements.
- Inform employees about the incident and necessary precautions.
Strengthening Defenses
- Patch systems regularly to close security gaps.
- Enhance email filtering and endpoint security measures.
User Awareness
- Conduct training to recognize phishing attempts and suspicious activity.
- Promote best practices for data handling and password management.
Policy & Procedure
- Develop and routinely update incident response plans focusing on ransomware scenarios.
- Establish clear escalation pathways for rapid decision-making.
Post-Incident Review
- Analyze the incident to identify lessons learned.
- Adjust security policies and controls accordingly to prevent recurrence.
Stay Ahead in Cybersecurity
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
