The State of Cyber Extortion Today

Ransomware remains one of the greatest financial and operational threats facing organizations worldwide. In just the first half this year, Flashpoint identified over 6,256 ransomware attacks across
all sectors, and with the rapid advancement of generative artificial intelligence (AI), the stakes have never been higher.

AI has shaped the illicit ransomware economy into a highly commoditized utility, fundamentally expanding the threat actor operational scale. Flashpoint has observed ransomware operators aggressively deploying autonomous, agentic AI systems that have created a massive oversupply of entry tools across the cybercriminal underground, drastically lowering the financial barrier to entry for emerging threat actors.

This report aims to equip Cyber Threat Intelligence (CTI) professionals, threat hunters, and security leaders with the actionable knowledge and insights they need to more effectively anticipate, prevent, and respond to the evolving ransomware threat landscape.

Read on to gain:

Understanding Ransomware: How the Cybercrime Ecosystem Operates

In the Flashpoint Global Threat Intelligence Report, our analysts identified 6,256 ransomware attacks in the first half of this year—a 45% surge fueled by the growing accessibility of Ransomware-as-a-Service (RaaS) and further powered by generative AI.

To better understand the ransomware landscape, RaaS and MaaS refer to a business model adopted by cybercriminals, in which threat actors purchase a “license” from the ransomware’s or malware’s developer, gaining access to its code, updates, and in some cases, customer support or additional tools such as keyloggers, cryptocurrency miners, and botnets.

Combined with the capabilities of illicitly-trained agentic AI systems, RaaS creates a force-multiplier effect that greatly lowers the barrier to entry, allowing unsophisticated attackers to leverage complex tools as long as they can afford a subscription. This automation has created a massive oversupply of entry tools across the ransomware ecosystem, driving the average market cost of sold initial access down by 69%, from $1,427 to just $439.

This commoditization of cybercrime creates a challenging environment for defenders. In today’s modern cybersecurity age, security teams have to contend with an interconnected criminal marketplace that offers an ever-evolving catalog of RaaS and MaaS. However, organizations need to monitor for other ransomware-adjacent threats.

Flashpoint monitored and aggregated billions of illicit forum posts and chat messages exchanged within threat actor communities—spanning across ransomware operators, infostealer advertisements, data breach sales, and solicitations for specific vulnerability exploits and zero-days—all of which fuels the ransomware lifecycle by empowering attackers to identify potential exposure gaps and quickly exploit them.

Where and How Ransomware Strikes: The Latest Statistics, Victim Demographics, and Active Threat Groups

Across all sectors, Flashpoint found that manufacturing, business & consulting, and healthcare bore the brunt of ransomware attacks, accounting for 18%, 13%, and 9% of attacks respectively. While ransomware affects organizations globally, over 43% of attacks targeted companies based in the United States, due to the value of the data US organizations maintain and a demonstrated high willingness to pay.

RaaS groups are responsible for the vast majority of reported attacks, with Qilin being the most prolific, followed by Akira, 0APT, The Gentlemen, and Dragon Force. The top five RaaS groups were responsible for 44% of this year’s reported ransomware attacks.

What Are the Stages of a Modern Ransomware Attack?

Ransomware attacks are not isolated incidents; they are often part of a complex, multi-stage operation that weaves together various tactics, tools, and procedures. To truly understand the ransomware threat, organizations need to view it as a dynamic process that unfolds over time. This wide angle lens is crucial for security teams to effectively defend against it, respond to potential attacks, and mitigate the risk of future incidents.

Stage 1: Cyber Reconnaissance and Planning

During the recon and planning phases of a ransomware attack, threat actors hone in on potential victims, gathering any information they can find. With the rise of illicitly-trained AI, these processes are taking place faster and at a greater scale than ever before. Leveraging these systems allows attackers to assess a target’s security posture, look for misconfigured databases, outdated systems and software, or solicit for stolen data—simultaneously and repeatedly until initial access is found.

However, automated scanning is rarely a solo endeavor; it feeds directly into a highly specialized criminal marketplace. The more sophisticated the threat actor group is, the harder it is to defend against. Larger groups such as Qilin, DragonForce, and the previously dominant LockBit, often work with access brokers, individuals or groups that specialize in gaining unauthorized access and then sell that access to others. Depending on the scale, projected ransom of the target, and what they find, these brokers may bring in additional cybercriminals that add additional “value” to the campaign—such as expertise in the development of vulnerability exploits, or access to sizable botnets for large scale Distributed Denial-of-Service (DDoS) attacks.

Stage 2: Gaining Initial Access

Preventing ransomware requires a robust security program that can detect and defend against a range of related cyber threats. By learning from their reconnaissance, threat actors will leverage any exposure gaps to create openings for initial access.

Here are some of the most common tactics threat actors leverage:

1. Phishing and Social Engineering to Penetrate Corporate Networks

Phishing remains a cornerstone of many ransomware attacks, often serving as the initial point of entry for threat actors seeking to infiltrate an organization’s defenses. It is a deceptive technique that employs social engineering to trick targets into either divulging sensitive information or downloading malicious software. While simple, phishing attacks have been proven to be incredibly effective, especially when combined with other tactics and technologies.

Whether it is by casting a wide net or by using a targeted approach via spear-phishing, generative AI is playing a major role by becoming a force multiplier for threat actors, with reported phishing attacks rising significantly since the introduction of Large Language Models (LLMs). The ability of LLMs to bypass language barriers, replicate writing styles, and analyze vast amounts of data—such as social media profiles, company websites, and news articles—repetitively and continuously, has helped malicious actors tremendously in their illegal campaigns.

2. Infostealers to Compromise Enterprise Credentials

Adding to the challenge of ransomware is information-stealing malware—or infostealers for short—which has become the go-to MaaS for threat actors. Serving as a pivotal entry point for ransomware campaigns, infostealers are malicious programs designed to stealthily capture sensitive data from infected devices, including login credentials, financial information, and system data.

They are inexpensive, easy to use, and are readily available on underground forums and dark web marketplaces. These factors have made infostealers increasingly essential to threat actors, driving a 27% increase in operations during the first half of this year compared to the same period last year.

Additionally, Flashpoint found that stealers compromised over 1.7 billion unique credentials in the first half of this year, extracted from 7.4 million devices and hosts that were infected with prominent strains, such as Vidar, StealC, and Lumma clones. Ransomware operators frequently leverage these stolen account credentials—using any valid cookies and passwords to bypass security measures, move laterally, escalate privileges, and ultimately deploy ransomware.

3. Vulnerability Exploits and Zero-Days to Infiltrate Systems

Vulnerability exploits often serve as the initial access point for a ransomware attack. Attackers actively scan for and target systems with known vulnerabilities, particularly those that have not been patched or updated. Once a vulnerability is identified, they can leverage publicly available exploits, develop their own, or solicit for exploit code to gain a foothold in the target network.

The sheer volume of vulnerabilities with exploits and proof-of-concepts presents a daunting challenge for defenders. Flashpoint continues to see unprecedented growth in published vulnerabilities with a significant percentage having a public exploit code at disclosure. Coupled with recent developments such as Anthropic’s Mythos and similar AI models potentially discovering thousands more, the timeline between disclosure and exploitation is drastically shrinking.

Every exploitable vulnerability represents a potential exposure. Therefore, patching them is critical. However, remediating or mitigating every exploitable issue in a timely manner is an incredibly resource-taxing and complex task. Threat intelligence can significantly streamline this process by providing much-needed context into an issue’s ease of access (location) and solution—while also providing additional insights such as real-time threat actor discussions. 

Leveraging this kind of metadata that is not readily accessible in sources such as the Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD), security teams can better understand which vulnerabilities are being actively exploited and solicited, enabling organizations to focus on those issues first.

Stage 3: Lateral Movement and Privilege Escalation

Once threat actors gain initial access, attackers will systematically spread their control leveraging stolen credentials and additional vulnerability exploits. While this lateral movement takes place malicious actors locate valuable data, critical systems, and more potential targets for encryption.

It is important to note that lateral movement is usually not a linear process. Threat actors adapt their tactics based on the network’s topology, security measures, and available targets, maneuvering opportunistically within the network. This means that attackers may reuse the very same techniques and tactics used during their initial infiltration. They may choose to move silently within the network, installing more illicit tools like keyloggers or screen capture software to acquire fresh user credentials. Additionally, they will exploit misconfigured network shares using weak or shared passwords, and take control of unsecured remote desktop protocols (RDP).

After moving throughout the network malicious actors will seek to escalate their privileges. By elevating their access rights, they gain increased control over critical systems, enabling them to disrupt and keep legitimate users out, or to exfiltrate and encrypt data.

This is usually done in the following ways:

Stage 4: Encryption Payload and Data Impact

The encryption phase marks the culmination of the ransomware attack, the moment when the attackers’ true objective is revealed. Having gained access, moved laterally, and escalated privileges, attackers now deploy the payload, encrypting critical data and systems, and holding the organization hostage.

The ransomware payload can come in multiple forms, each with its own characteristics and objectives:

Stage 5: Extortion and Ransom Negotiation

Once ransomware actors have encrypted sensitive data or locked access to critical systems, they initiate the extortion phase. The attackers demand payment, typically in cryptocurrency, in exchange for a decryption key, or a promise not to publicly release exfiltrated data. This stage is designed to apply maximum psychological and operational pressure on the victim organization. 

Attackers typically will use:

• Double Extortion: Attackers threaten to release sensitive data publicly if the ransom is not paid, in addition to encryption.
• Triple Extortion: Threats extend to targeting third parties, such as customers or suppliers, amplifying reputational damage. 
• Deadlines: Increasing ransom amounts over time or threatening permanent data loss to create urgency. 
• Proof of Access: Sharing snippets of stolen data or demonstrating decryption capability to coerce payment.

Flashpoint research, coupled with findings from Chainalysis, shows a rising volume of ransomware attacks and falling revenue. Despite a 45% volume increase compared to the same period last year, total on-chain ransomware payments fell by approximately 8% to $820 million.

This divergence is largely due to the share of victims choosing to pay ransoms dropping to a potential all-time low of 28%. As organizations improve their incident response, implement viable data backups, and face increased regulatory scrutiny, the frequency of payouts has plummeted. However, to compensate for this trend, attackers are successfully extracting larger sums from victims that do pay.

Evaluating Data Blast Radius During Extortion

The threat of leaking sensitive information and stolen files is the main source of leverage attackers have. Therefore, it is critical to determine whether leaked files have actually been published and what they truly contain. Solutions such as Flashpoint Ignite make it possible for security teams to streamline this assessment by providing real-time visibility into leaked file download statuses and start dates.

This empowers incident response teams to quickly verify threat actor claims, gauge operational impact, and submit Requests for Information (RFIs) to Flashpoint analysts for deeper file analysis.

The Negotiation Process

The negotiation process can be fraught with challenges, as organizations must navigate the legal, ethical, and operational risks associated with paying—or refusing to pay—the ransom. In some cases, paying off threat actors could void cyber insurance policies. However, a refusal may result in an even longer shutdown period. Therefore, it’s essential for organizations to take a measured and informed approach, leaning on the expertise of internal and external stakeholders to make the best possible decisions.

Given the complex dynamics of ransomware extortion, preparation and adherence to best practices can significantly improve an organization’s ability to manage this stage effectively:

Stage 6: Incident Response, Recovery, and Mitigation

The final stage focuses on recovering encrypted data, containing the threat, restoring systems, and implementing measures to prevent future attacks. However, recovery is not just about technical fixes; it’s a holistic process that involves careful planning, cross-team collaboration, and a commitment to transparency. Organizations must act swiftly, yet strategically to ensure that attackers are not able to move unfettered across the network. Only once the threat is contained can systems be restored securely, vulnerabilities addressed, and trust with stakeholders rebuilt.

However, attackers are well aware that backups are the main reason victims choose not to pay. As such, certain threat actors and groups will contract experts who specialize in attacking and corrupting both on-network and offline backups. Therefore, security teams need to know exactly which team is responsible for maintaining and safeguarding them and ensure that they are not corrupted during an attack.

Once systems are restored and operations are back online, it’s time to focus on reducing the likelihood of a repeat attack. This involves proactive threat monitoring, using threat intelligence to capture any further discussions about stolen credentials or data pertaining to you or a partner third party’s data.

In addition, leveraging forensics, security and IT teams should secure previously and potentially compromised accounts—forcing password changes, re-establishing MFA, and removing any unneeded privilege access. Lastly, it is critical that business leaders and security staff create a formal response plan (if not previously created), and participate in regular tabletop exercises.

How to Mitigate Ransomware Risk Using Best-In-Class Threat Intelligence Data

Implementing End-to-End Protection Across the Attack Lifecycle

Flashpoint offers a holistic approach to ransomware defense by combining proactive threat intelligence and organizational readiness. Designated as a Customer Favorite in The Forrester Wave™: Cyber Threat Intelligence Services, Q3 2026, Flashpoint equips your team to prevent attacks, respond swiftly during incidents, and ensure rapid recovery with minimal disruption.

Flashpoint’s comprehensive approach to ransomware protection extends beyond the traditional focus on prevention and offers comprehensive assistance throughout every stage of the ransomware process, from reconnaissance and planning to encryption and impact. We recognize that true resilience requires the ability to respond effectively to attacks and build long-term defenses.

Flashpoint Prevention and Response

Our Threat Response and Readiness (TR2) provides organizations with the expertise and resources they need to navigate the complexities of a ransomware incident and cyber extortion. When combined with our suite of CTI and Vulnerability Intelligence solutions, business leaders and security teams gain access to a complete ransomware solution that encompasses: