"To be clear, ransomware isn't going anywhere, and adversaries continue to innovate. But the data shows a clear strategic pivot away from loud, destructive attacks toward techniques designed to evade detection, persist inside environments, and quietly exploit identity and trusted infrastructure. Rather than breaking in and burning systems down, today's attackers increasingly behave like Digital Parasites. They live inside the host, feed on credentials and services, and remain undetected for as long as possible."
"For the past decade, ransomware encryption served as the clearest signal of cyber risk. When your systems locked up and your operations froze, compromise was undeniable. That signal is now losing relevance. Year over year, Data Encrypted for Impact (T1486) dropped by 38%, declining from 21.00% in 2024 to 12.94% in 2025. This decline doesn't show reduced attacker capability. It reflects a deliberate shift in strategy instead."
Over 1.1 million malicious files and 15.5 million adversarial actions observed across 2025 show attackers moving from loud disruption to long-term invisible access. Ransomware encryption (T1486) declined 38%, falling from 21.00% in 2024 to 12.94% in 2025, signaling a strategic pivot rather than reduced capability. Threat actors increasingly prefer data extortion, quiet exfiltration, credential and token harvesting, and techniques that enable extended persistence. Attackers exploit identity and trusted infrastructure, keep systems operational to avoid detection, and use living-off-the-land methods. Public focus on visible outages masks where defenders are losing visibility into sustained, stealthy compromises.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]