Ransomware and Data Extortion: What Has Changed

Key judgments

1. Encryption is no longer the center of the incident. The leverage now comes from stolen data and from removing the victim’s ability to recover. Mandiant describes a systemic shift towards recovery denial. Coveware still observes data-theft-only extortion. CISA’s Scattered Spider advisory describes actors who steal data first and may encrypt afterwards. Fact.

2. Payment economics have weakened. Chainalysis reports an all-time low payment rate of 28%, down from 62.8% the previous year, while claimed attacks rose 50%. Coveware also reports a record low payment rate, with data-exfiltration-only cases lowest at 15%. Fact, from two datasets that measure different things. Whether operators respond with harder pressure tactics is a hypothesis this brief cannot confirm.

3. Entry has moved towards identity, edge devices and earlier compromise. Mandiant ranks exploits first at 32% of intrusions and voice phishing second at 11%, with email phishing at 6%. In ransomware cases, prior compromise was the leading vector at 30%, double the previous year’s share. CISA’s Akira advisory points to VPNs without MFA and exploited edge devices. Fact.

4. Timelines are short. Mandiant’s median handoff from initial access to a second group is 22 seconds. CISA reports Akira exfiltrating data in just over two hours from initial access in some incidents. Fact.

5. Targets are chosen to deny recovery. Backup systems, identity services and hypervisors are named repeatedly. Akira’s encryptors now cover VMware ESXi, Hyper-V and, more recently, Nutanix AHV. Fact.

Then and now

What has not changed

The structure of the business is the same. Affiliates and access brokers feed operators. Familiar tooling still appears in advisories: AnyDesk and other remote access tools, Rclone and WinSCP for exfiltration, MEGA as a destination. Active Directory remains the prize, because whoever controls it controls everything beneath it.

The basics also still address most of what the advisories document. MFA on VPN access, prompt patching of internet-facing systems, immutable and offline backups, and tight control over remote access tools are the mitigations CISA repeats in both the Akira and Scattered Spider advisories. The change is that organizations with these controls now face attackers who aim at the controls themselves.

The first 24 hours, rewritten

1. Assume data has left, and start scoping on day one. Notification duties, negotiation posture and legal privilege all depend on what was taken. Which clocks start, and when, varies by jurisdiction and needs legal advice early.

2. Assume your communications are watched. CISA reports that Scattered Spider actors joined incident response calls and monitored Slack, Teams and Exchange Online to follow the defenders’ progress. Move incident coordination to an out-of-band channel before discussing containment.

3. Decide who holds recovery authority and where the clean copy lives. Mandiant frames the position starkly: pay or rebuild. If the backup console, the hypervisor management plane and the identity system were all inside the blast radius, the clean copy must sit somewhere none of them can reach.

4. Rebuild trust in identity before restoring workloads. Mandiant describes attackers exploiting misconfigured certificate templates to create administrator accounts that bypass password rotation. Resetting passwords does not remove access that does not depend on them.

5. Settle the payment decision framework before it is needed. Coveware’s warning is that historical outcome data are averages, and that payment does not guarantee deletion. Who decides, on what information, with which legal, sanctions and insurer input, should be agreed in calm conditions. This brief does not recommend for or against payment.

Reading the numbers carefully

Coveware reports that its median payment fell by half against the previous quarter while the average rose 176%, which it attributes to a few large payments in campaigns against law firms. Chainalysis reports that the median on-chain payment rose from $12,738 to $59,556. Those figures look contradictory. They are not, because one comes from negotiated cases that Coveware observes and the other from payments visible on-chain. Averages in this market move on a handful of large payments, and a falling payment rate is not a falling infection rate. Chainalysis reports claimed attacks up by half.

The Chainalysis figures reach this brief through press coverage rather than the original report, which is why the brief uses only the headline numbers and attributes them.

Questions for leadership

• If production identity, backups and virtualization management were all unavailable tomorrow, where is our clean recovery path, and who can authorize using it?

• Who decides on payment, on what criteria, and was that settled before an incident rather than during one?

• At what point in an incident do we assume data has been stolen, and who owns the scoping work from that moment?

Sources

• Mandiant (Google Threat Intelligence), M-Trends report — Annual analysis of Mandiant incident response investigations

• Coveware, adverse cyber extortions are more common than commonly advised — Quarterly ransomware negotiation analysis

• Chainalysis findings on ransomware payments, as reported by BleepingComputer — Secondary report of on-chain payment analysis

• CISA, FBI and partners, Akira ransomware joint advisory — Government advisory, updated edition

• CISA and partners, Scattered Spider joint advisory — Government advisory with updated tactics and mitigations