Ransomware in 2026: the playbook, the analysis, and the response

Ransomware is the financially-dominant category of cybercrime in 2026, well ahead of business email compromise in raw losses and ahead of every other malware family by impact per incident. The shape of the threat has changed substantially since the WannaCry-era picture most security awareness training still uses. The operators who run these campaigns work in something close to a real software company: tiered staff, professional negotiation, public PR, and quarterly product releases. The defenders work against an ecosystem rather than against individual malware families. The sections below walk the playbook, the analysis side, and the response sequence, with current examples from the 2023-2025 incident chain.

See also advanced malware analysis and cloud security for adjacent topics.

The RaaS model

#

The single most important fact about modern ransomware is the Ransomware-as-a-Service division of labor. The malware doesn’t get written by the same person who breaks into the target.

Operators (the developers) maintain the malware codebase, the payment infrastructure (Tor-hosted negotiation portals, the public Data Leak Site), the decryptor distribution, and the cryptocurrency wallet plumbing. They take 20-30% of every ransom paid.

Affiliates (the operators in the engagement sense) do the actual breach work: phishing, exploiting public-facing vulnerabilities, buying access from Initial Access Brokers (IABs), pivoting through the target network, exfiltrating data, and detonating the encryptor. They keep 70-80% of the ransom.

This split has dramatic implications for both the threat picture and the defensive posture. The affiliate doesn’t need crypto or implementation skill; they need access. The operator doesn’t need an actual victim portfolio; they need a product. Each Russian-speaking forum post offering to sell access to a Fortune 500 network is feeding directly into this pipeline, and the affiliates buying that access are the operators on the breach side of any given engagement.

Double extortion

#

Pre-2019, ransomware just encrypted files. Targets with working backups could restore and ignore the demand. Maze pioneered double extortion in 2019: exfiltrate data before encryption, then threaten to publish if the ransom isn’t paid even when decryption isn’t needed. The threat shifts from “your files are gone” to “your customer database goes on the leak site Friday.”

Once you’ve added the data leak threat, the encryption becomes optional. BianLian took the next step in January 2023 after Avast released a decryptor for their previous locker: they dropped encryption entirely and operate as a pure data-extortion crew. The breach pattern is the same; the data exfiltration is the only payload. CISA published a joint advisory on the shift in May 2023.

Triple extortion

#

Some groups (Conti was the first widely-noted example) layered DDoS attacks against the victim’s public infrastructure during negotiation. The pressure model is “your files are encrypted, your data is on the leak site Monday, and your customer-facing systems are down right now.” Triple extortion is less common in 2026 than it was in 2022, mostly because the DDoS adds noise without much extra leverage when the data leak threat is already on the table.

The modern incident chain

#

A 2024-2025 ransomware affiliate’s working pattern, drawn from the major incidents of that period:

1. Initial access. Buy from an IAB, exploit a known unpatched vulnerability, or phish. The dominant initial access vectors in 2023-2024 were Citrix Bleed (CVE-2023-4966) for VPN/NetScaler exposure and MOVEit Transfer (CVE-2023-34362) for file-transfer servers.
2. Lateral movement and privilege escalation. Standard AD attack chain: Kerberoasting, AS-REP roasting, BloodHound enumeration, abuse of misconfigured ACLs, eventual Domain Admin.
3. Data exfiltration. Move sensitive data out of the network over time, usually via cloud storage (Mega, Rclone to S3, Azure Storage) at a rate that doesn’t trip volume-based detection.
4. Encryption. Detonate the ransomware. Modern variants kill backup services, delete shadow copies, encrypt connected backups, and target ESXi/Hyper-V to take out whole virtualization clusters at once.
5. Negotiation. Tor-hosted portal. Initial demand typically inflated 3-5x what the operator expects to settle for.

The Cl0p-led MOVEit campaign in May-June 2023 is the textbook modern example: a SQL injection (CVE-2023-34362) in Progress MOVEit Transfer hit roughly 3,000 US organizations and 8,000 worldwide. Cl0p didn’t encrypt at all on most victims; the LEMURLOOT webshell stole data and Cl0p extorted on the threat of publication. The MOVEit campaign is the canonical example of how data extortion at scale works without any of the traditional ransomware encryption signal that defenders trained on.

Notable families

#

The current ransomware ecosystem changes faster than most security writing can keep up with, but a snapshot of who matters as of mid-2026:

Qilin is the highest-volume RaaS as of late 2025 / early 2026, running on a Rust-based locker. They moved into the top spot after RansomHub went dark in April 2025. Heavy targeting of critical infrastructure sectors.

Akira is the persistent second-tier RaaS, in operation since early 2023, known for targeting small-to-midsize businesses and for relatively cheap ransom demands (often 5-7 figures rather than the 8+ figures the top tier asks for). Cross-platform locker (Windows, Linux/ESXi). Cisco published detailed Talos coverage in 2024.

Cl0p continues to specialize in vulnerability-driven mass campaigns. After MOVEit they hit GoAnywhere MFT, Accellion FTA, and continued opportunistic exploitation of file-transfer products. Different operating model from the affiliate-driven RaaS pattern; Cl0p mostly runs their own operations.

Play, Medusa, INC Ransom are the steady mid-tier groups operating into 2026.

Royal/BlackSuit is the rebrand of the Conti spinoff that hit Dallas in 2023. Primarily C++ locker (despite some reporting suggesting Rust).

The big absentees from the 2026 picture are LockBit and BlackCat/ALPHV, both of which got hit hard in 2024:

• LockBit was disrupted by Operation Cronos on February 20, 2024 (NCA + FBI seized 34 servers, recovered 7,000+ decryption keys, identified LockBitSupp as Dmitry Khoroshev in May 2024 with a $10M reward). LockBit 5.0 launched as a rebuild attempt; another breach in May 2025 hit the rebuilt infrastructure. The brand is severely diminished but not eradicated.
• BlackCat/ALPHV got hit by FBI seizure in December 2023, attempted to rebuild, and then exit-scammed in March 2024 after their affiliate “Notchy” extorted Change Healthcare for $22M; the operators kept the full payment instead of paying the affiliate. The ecosystem hasn’t forgiven them.

The major 2024 high-impact incident that defines current incident response thinking is Change Healthcare (the UnitedHealth subsidiary processing US medical claims): an ALPHV affiliate compromised them in February 2024 via an unsecured Citrix portal that lacked MFA, exfiltrated terabytes of patient data, and encrypted the core claims-processing systems. Change paid the $22M ransom. The exit-scam happened next. The downstream disruption to US healthcare billing lasted months.

Reversing a sample

#

For analysts working on a captured sample, the standard workflow:

1. Acquire safely. Pull the sample into an isolated lab. VirusTotal is fine for hash lookups, but uploading a fresh sample submits it to a corpus the threat actor may monitor.

2. Identify the family. ID Ransomware accepts a ransom note or an encrypted file and returns the family identification when known. For unknown samples, the No More Ransom project hosts free decryptors for families whose keys have been recovered.

3. Static analysis. Open the PE in Ghidra or IDA. The classic indicators in the import table:

• Cryptography APIs (CryptEncrypt, CryptGenKey, or static OpenSSL/Crypto++ references)
• File system traversal (FindFirstFile, FindNextFile)
• Network share enumeration (WNetOpenEnum, WNetEnumResource)
• Shadow copy deletion (vssadmin, wmic shadowcopy, references to backup services)

Then look at strings. Find references to vssadmin, wbadmin, service names commonly killed before encryption (MSSQLSERVER, Veeam, BackupExec). These usually live near the calling code, and the cross-reference clicks through to the function that runs the encryption loop.

4. Walk the encryption routine. Find the function that calls FindFirstFile and follow the loop. Inside, look for:

• Exclusions. Most ransomware skips windows\, program files\, appdata\, and known system folders so the OS stays usable enough for the victim to pay.
• Key generation. CryptGenKey or a custom RNG. Modern families use AES-256 for the per-file or per-extent key, RSA-2048 or higher (sometimes Curve25519) to wrap the symmetric key.
• Per-file vs per-session keys. Per-file is stronger crypto but slower; per-session is faster but lets you recover everything if you find the session key in memory.

5. Extract the config. Modern RaaS payloads embed configuration: C2 domains, the affiliate ID (for revenue-share tracking), the public key, the list of services to kill, the list of folders to exclude. The config is usually XOR-obfuscated or RC4-encrypted with a key stored in the same binary. Locating and decoding it gives both the family-specific indicators and the affiliate identifier, which is useful for attribution.

6. Behavioral analysis. Detonate in a sandbox (CAPE Sandbox is the maintained Cuckoo fork most analysts now use). The behavior of interest:

• File access patterns (alphabetical, depth-first, or random?)
• Service kills before encryption starts
• C2 callouts and the negotiation portal address
• Whether vssadmin Delete Shadows /All /Quiet runs early in the flow

7. Memory forensics. Use Volatility 3 on a sample taken mid-execution to look for the in-memory key material:

python3 vol.py -f memory.dmp windows.pslist
python3 vol.py -f memory.dmp windows.malfind
python3 vol.py -f memory.dmp windows.dumpfiles --pid <ransomware_pid>

A strings pass against the process dump often turns up the active session key, especially for families that don’t bother to zero it out after use. Get-Volatility’s windows.malfind will catch the RWX region where the locker keeps its working memory.

The big historical incidents

#

These are the ones every analyst sees referenced.

WannaCry (May 12, 2017) spread worldwide using EternalBlue (CVE-2017-0144), the NSA SMB exploit leaked by Shadow Brokers a month earlier. Infected ~200,000 systems across 150 countries; damage estimates range from hundreds of millions to about $4 billion depending on which study you trust. Marcus Hutchins discovered the kill switch domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com) by accident during analysis and registered it, which halted the spread. North Korean attribution (Lazarus Group) followed.

NotPetya (June 27, 2017) started as a supply-chain compromise of M.E.Doc, a Ukrainian accounting application. Used EternalBlue, EternalRomance, Mimikatz, and PsExec to spread. Functionally a wiper disguised as ransomware: the encryption key was never recoverable even on payment. Maersk lost $200-300M; global damages estimated around $10B. Attributed to GRU/Sandworm by US, UK, and other government sources. The reason NotPetya matters for analysis is that it’s the canonical example of how a ransomware-shaped attack can be sabotage with no recovery path.

ESXiArgs (February 3, 2023) is the most-cited example of the ESXi-targeting trend. Mass exploitation of CVE-2021-21974 (OpenSLP heap overflow in unpatched ESXi servers), encrypted ~2,400 servers worldwide before mitigation guidance went out. Each encrypted hypervisor took down many virtual machines, which is why ESXi targeting became a tier-one priority for ransomware crews.

ESXi targeting specifically

#

Encrypting one ESXi server takes out the dozens of VMs running on it, so virtualization-aware ransomware is high leverage. The pattern:

1. Exploit a public-facing vulnerability (the OpenSLP heap overflow in CVE-2021-21974 for ESXiArgs, vCenter SSRF chains for others)
2. Get root shell on the hypervisor
3. Kill VMs (esxcli vm process kill)
4. Encrypt .vmdk, .vmx, .vmem files using openssl or a custom Linux ELF locker
5. Replace /etc/motd with the ransom note

The defense pattern: patch ESXi promptly (the same advice that gets ignored on every ESXi survey CISA publishes), disable SLP if unused, never expose ESXi management interfaces to the internet, and use TPM with Secure Boot for the host. Most successful ESXi ransomware in 2023-2025 hit hosts that had been internet-exposed unpatched for over a year.

Incident response, when it happens

#

When the ransom note appears, the work falls into three phases. The hardest part is staying disciplined while everything’s on fire.

Phase 1: Containment (the first hour)

#

The goal is to stop the spread without destroying the evidence:

• Disconnect, don’t power off. Pull the network cable. Disable Wi-Fi. Leave the machine running so the encryption keys may still be in memory.
• Isolate affected segments. Pull entire VLANs offline if the ransomware is spreading laterally. If a domain controller is involved, the AD forest may need to come offline.
• Preserve memory. A memory dump from an actively encrypting host can sometimes contain the session key. Use a hardware write-blocker if pulling disks.

Phase 2: Scope and analysis

#

• Identify the variant. ID Ransomware usually gives a family name within minutes. The family determines whether decryption is possible (No More Ransom decryptor) and what the operator’s typical playbook is.
• Trace the initial access. Phishing? Citrix Bleed? RDP? VPN? The hole has to be closed before the recovery work starts, or the operators come back during it. Firewall logs, AD authentication logs, and EDR telemetry from the days before the encryption are what most of the investigative work runs on.
• Determine what was stolen. Modern ransomware always exfiltrates first. Look at outbound flow data for the weeks before detonation. Anomalous transfers to cloud storage providers (Mega, Rclone uploads to S3 buckets, Azure Storage) are the typical pattern.

Phase 3: Eradicate and recover

#

• Rebuild from bare metal. Never trust a compromised host to be clean after a reset. Wipe and re-image.
• Restore from immutable, offline backups. Cloud backups that the affiliate had write access to are also compromised; the gold standard is air-gapped backups or immutable cloud storage with rotating credentials the attacker never had.
• Verify the restored data. Affiliates routinely sit in environments for weeks before detonating, so backups from those weeks may contain the implant. Scan everything before bringing systems back online.
• Reset credentials at scale. Force password reset for all users, rotate all service account credentials, rotate the KRBTGT Kerberos secret twice (24 hours apart) to invalidate any Golden Tickets the attacker might have minted.
• Decide on payment carefully. US OFAC sanctions some ransomware groups, making payment illegal regardless of business pressure. Most reputable incident response firms (Mandiant, CrowdStrike, Coveware) consult on this. The Change Healthcare exit scam in March 2024 is the canonical example of why payment doesn’t always end the incident.

Defenses that hold

#

The standard advice survives because the standard problems do. The controls that produce real risk reduction against ransomware in 2026:

• Patch internet-facing services within days, not months. Citrix Bleed, MOVEit, and the ESXi vulnerabilities all had patches available before mass exploitation. The targets had simply not patched.
• Multi-factor authentication on every external authentication surface, especially VPN and remote access. The Change Healthcare incident specifically turned on a Citrix portal without MFA.
• EDR with behavioral detection, not just signatures. Mass-encryption behavior (rapid file rename + write across many files) is one of the easier patterns for an EDR to catch and halt.
• Immutable, offline backups, tested by restoring data quarterly. Backups nobody has verified will work usually don’t.
• Network segmentation that meaningfully limits lateral movement. A flat /16 with no east-west firewalling is what makes a single phishing click into an enterprise-wide encryption event.
• Cyber insurance with realistic incident-response retainers. The IR firm matters more than the policy. The retainer ensures someone shows up on the worst day.

The ransomware economy in 2026 is mature enough that no organization should treat being a target as hypothetical. The question is whether the controls in place catch the first stages of the attack and the response is rehearsed enough to handle the rest.