Ransomware coverage tends to describe the same attack over and over: a payload lands, files encrypt, a ransom note appears. That description was accurate several years ago. It is a poor description of how the most damaging ransomware incidents actually unfold today. The technology and the criminal business model behind it have both moved, and defenders who are still planning against “a virus that encrypts files” are planning against yesterday’s threat.

Three shifts matter most: the move from single to double extortion, the professionalization of the ransomware supply chain through affiliate-based models, and a smaller but growing set of operators skipping encryption entirely. Each changes what a defensible posture actually requires.

What is double extortion, and why did it become standard?

Early ransomware had one lever: encrypt the victim’s files and demand payment for the decryption key. That lever stopped working as well once organizations improved backups — a victim with clean, tested backups can simply restore and ignore the ransom demand, and no amount of encryption strength changes that.

Ransomware operators adapted by adding a second lever: before encrypting anything, they exfiltrate a copy of the victim’s sensitive data. The ransom then covers two separate threats — pay to get a decryption key, and pay again (or the same payment covers both) so the stolen data isn’t published or sold. This is double extortion, and it directly neutralizes the “we have backups” defense: restoring from backup solves the availability problem but does nothing about data already sitting on an attacker’s leak site. Dedicated extortion leak sites, first popularized by groups following the Maze playbook, are now a standard feature of the ransomware ecosystem, used to pressure victims publicly and prove the exfiltration claim is real.

The practical consequence for defenders is that backup strategy alone is no longer a sufficient ransomware control. Preventing exfiltration — through data loss prevention, egress monitoring, and limiting what any single compromised account can reach — has become as load-bearing as backup integrity. CISA’s #StopRansomware guidance treats data exfiltration prevention and detection as a core control precisely because of this shift.

How did Ransomware-as-a-Service change the economics of an attack?

The second major shift is organizational rather than technical. Ransomware increasingly runs on a Ransomware-as-a-Service (RaaS) model: a core group develops and maintains the encryption payload, the leak-site infrastructure, and the negotiation tooling, then leases access to “affiliates” who carry out the actual intrusions in exchange for a cut of the ransom — commonly 70-80% to the affiliate, with the remainder to the RaaS operator.

This matters because it decouples the technical skill of building ransomware from the operational skill of breaking into networks. A RaaS affiliate does not need to write malware; they need to gain initial access and move it to the point of deployment, using tooling someone else built and maintains. That has lowered the skill floor for running a ransomware operation and increased the raw number of active affiliates, even as any single ransomware “brand” rises, gets disrupted by law enforcement, and is replaced by a rebrand or successor group. Names change more often than the underlying affiliate infrastructure does.

A related development is the initial access broker market: specialists who compromise a network — through a phished credential, an exposed RDP endpoint, a vulnerable VPN appliance — and then sell that access on criminal forums to whoever wants it, ransomware affiliates included. This further specializes the supply chain: one actor gets in, a different actor decides what to do once inside. For defenders, it means the earliest phase of what becomes a ransomware incident is often executed by an unrelated group weeks or months before the ransomware payload itself is ever deployed, which is part of why dwell-time reduction and early-stage detection matter as much as anti-ransomware tooling.

Are some groups skipping encryption altogether?

A newer trend, still a minority of incidents but a growing one, is extortion without encryption. The group exfiltrates data and threatens to publish or sell it, but never deploys an encryption payload at all. Operationally this is simpler for the attacker — no need to build or evade detection for ransomware binaries, no risk of a botched encryption routine corrupting data beyond recovery, no ransomware-specific behavioral signatures for defenders to detect. The pressure comes entirely from the threat of disclosure.

This shift is worth taking seriously because it breaks a common mental model: an organization that has invested heavily in anti-encryption and backup-resilience controls, and reasonably considers itself hardened against “ransomware,” can still be extorted by a group that never touches an encryption routine at all. The controls that matter against this variant — data classification, DLP, monitoring for large or unusual data transfers, and limiting standing access to sensitive repositories — sit closer to data-loss-prevention practice than to traditional anti-malware defense.

What do the trend numbers actually show?

Two sources are worth anchoring to rather than headline anecdotes. The FBI’s Internet Crime Complaint Center (IC3) annual report publishes yearly ransomware complaint and reported-loss figures broken out by sector, and is a useful baseline for year-over-year direction even though it necessarily undercounts incidents victims never report. The Verizon Data Breach Investigations Report (DBIR), published annually, tracks ransomware’s share of breaches with a broader confirmed-incident dataset and consistently shows ransomware as one of the top action types across multiple years of the report, with double extortion characteristics present in a majority of ransomware-involved breaches it analyzes.

Neither source supports the idea that ransomware is fading — sector targeting shifts (healthcare, education, and local government appear disproportionately as targets across both datasets, generally reflecting weaker security budgets and higher operational pressure to pay rather than any special attacker interest), and specific group names come and go as law enforcement actions and rebrands cycle through the ecosystem, but the underlying volume and the double-extortion / RaaS structure described above has been persistent across recent reporting periods rather than a one-year spike.

Given double extortion, egress and data-loss controls deserve parity with backup investment rather than being an afterthought. Given RaaS and initial access broker specialization, detecting and disrupting the early stages of an intrusion — credential compromise, unusual remote access, lateral movement — matters more than waiting for ransomware-specific signatures, since by the time an encryption payload runs, exfiltration has frequently already happened. Given encryption-less extortion, sensitive-data monitoring and DLP controls need to stand on their own merits, not merely as a backstop to anti-ransomware tooling.

None of this replaces the fundamentals: patch management for internet-facing services (a large share of ransomware intrusions still begin with a known, unpatched vulnerability), phishing-resistant MFA, and tested, offline or immutable backups. It does mean the fundamentals are necessary but no longer sufficient on their own, given how the extortion model itself has diversified.

This is also why ransomware is increasingly discussed as a data security problem rather than purely an endpoint or anti-malware one, and why organizations building out a threat intelligence function specifically track ransomware group activity, affiliate tooling, and initial-access-broker chatter, rather than treating “ransomware” as a single monolithic threat that one detection signature can cover. The trend data supports tracking the ecosystem, not just the malware family names that rotate through it.

Frequently Asked Questions

What is double extortion ransomware?

Double extortion is when attackers steal a copy of the victim’s data before encrypting it, then threaten to publish or sell the stolen data in addition to demanding payment for a decryption key. It neutralizes the defense of restoring from backup, since backups solve the encryption problem but not the separate threat of published stolen data.

What is Ransomware-as-a-Service (RaaS)?

RaaS is a criminal business model where a core group builds and maintains the ransomware payload and supporting infrastructure, then leases it to affiliates who carry out intrusions in exchange for a majority share of each ransom. It has lowered the technical skill required to run a ransomware operation and increased the number of active affiliates.

Do all ransomware groups encrypt data?

No. A growing minority of extortion operations skip encryption entirely and rely solely on the threat of publishing or selling stolen data. This makes anti-encryption and backup-resilience controls insufficient on their own — data loss prevention and egress monitoring are needed to address this variant specifically.

Are backups still worth investing in against ransomware?

Yes, but they only address the encryption/availability half of a double-extortion attack. Tested, offline, or immutable backups remain essential for recovering encrypted systems without paying, but they do nothing to prevent stolen data from being published, which requires separate exfiltration-prevention and monitoring controls.

What is an initial access broker?

An initial access broker is a specialist who compromises a network and then sells that access on criminal forums, rather than carrying out further attacks themselves. Ransomware affiliates are common buyers. This specialization means the intrusion that eventually leads to ransomware is often executed by a different, unrelated actor well before deployment.