Ransomware in 2026: Attacks Are Down, But Payouts Are Bigger Than Ever.

The ransomware landscape is evolving. Total attack volume dropped 23% in 2025-2026, but average ransom demands increased by 67% to $1.5 million. The data tells a clear story: ransomware gangs are becoming more selective, targeting organizations with the resources — and pressure — to pay.

The Shift to Big Game Hunting

Instead of spraying attacks across thousands of small businesses, sophisticated ransomware operations are conducting weeks of reconnaissance before striking high-value targets: hospitals, law firms, manufacturing companies, and government agencies. These organizations face immediate operational disruption and often have inadequate backups.

How to Protect Yourself

The fundamentals haven't changed: maintain offline backups, segment your network, keep systems patched, and train employees to recognize phishing. But in 2026, add endpoint detection and response (EDR), implement zero-trust network access, and have an incident response plan that's been tested — not just written.

Why fewer attacks does not mean less danger

The decline in attack volume reflects a real shift in attacker economics, not a retreat. Mass-scale spray-and-pray campaigns have given way to highly targeted intrusions against organizations with deep pockets, cyber insurance, and time-sensitive operations. Hospitals, regional governments, port authorities, and law firms have replaced the long tail of small business victims that used to define the dataset. Each successful breach now nets seven or eight figures rather than the four or five figure paydays of the 2018 era, which is exactly the kind of consolidation that follows any maturing criminal market.

Data extortion without encryption is the year's defining trend. Groups like Cl0p, BianLian, and the post-takedown remnants of ALPHV have increasingly skipped the disruption phase entirely, exfiltrating sensitive data and demanding payment to prevent publication. This model bypasses the strongest defense most organizations have invested in: immutable backups. When your secrets are on a leak site, restoring from backup does not solve the problem, and the negotiation dynamics tilt sharply toward the attacker.

Initial access brokers continue to industrialize the upstream supply chain. Listings on Russian-language forums show stolen VPN and remote desktop credentials, cookies for SaaS dashboards, and edge appliance footholds sold for prices that have actually dropped year over year as supply grew. Ransomware affiliates can shop a marketplace, pay 5 to 10 thousand dollars for verified access to a Fortune 2000 environment, and skip the entire phishing and reconnaissance phase. Defending against this requires monitoring identity layer signals and patching edge devices on day-of cadence.

Law enforcement disruptions have visibly accelerated. The FBI's recovery of LockBit decryption keys, the takedown of the BlackCat infrastructure, and coordinated international actions against Trickbot and Conti affiliates have raised the cost of operating top-tier ransomware brands. Splinter groups proliferate, but they generally lack the operational maturity, double-extortion infrastructure, and reputation that made the predecessors so effective. The market is more fragmented but also less professional, with newer crews making errors that benefit defenders.

For defenders, the playbook is converging on a few high-leverage controls. Phishing-resistant multi-factor authentication everywhere, especially for VPN and remote desktop, blocks the dominant initial access vector. EDR with managed detection and response shortens dwell time from weeks to hours. Network segmentation prevents the lateral movement that lets a single foothold become enterprise-wide encryption. And rehearsed incident response, including legal counsel and external negotiators on retainer, makes the difference between a measured response and a panicked one that compounds the damage.

The affiliate model is consolidating around fewer, larger crews

After the LockBit takedown in Operation Cronos and the BlackCat exit scam in 2024, the ransomware-as-a-service market did not collapse. It consolidated. Chainalysis tracking shows that by early 2026, roughly 65 percent of confirmed payments flowed to just five active brands: RansomHub, Akira, Play, Medusa, and Qilin. Each runs a tighter affiliate vetting process, demands higher technical proficiency, and pays out larger per-incident splits to retain top operators. The fragmented long tail of low-skill affiliates has thinned considerably.

For defenders, this concentration is a mixed signal. Fewer brands means law enforcement can focus, and the FBI, Europol, and the NCA have been more effective at infrastructure disruption when there are fewer moving targets. But the surviving operators are more disciplined, better at OPSEC, and more selective about victims. They pick targets where they have already mapped the network through initial access brokers, and the resulting attacks complete faster and demand more.

Initial access brokers are now the real bottleneck

The economics of modern ransomware separate intrusion from extortion. Initial access brokers, IABs, harvest credentials, exploit edge appliances, and sit on access for days or weeks before selling it on Russian-language forums for typical prices between 2,000 and 30,000 USD depending on company size and sector. Mandiant's 2025 M-Trends report found that IABs were the source of access in over 40 percent of ransomware cases where the chain could be reconstructed. The implication for defenders is straightforward: most of the attack happens before anyone deploys ransomware.

This is why detection-in-depth at the access layer matters so much more than endpoint signatures. Monitor your edge VPN devices, your Citrix Gateway, your Fortinet and SonicWall appliances for anomalous logins. Force MFA on every account, including service accounts. Treat any RDP or SSH exposure to the public internet as a near-certain breach within twelve months. The brokers are patient and they are systematic. They will find the one unpatched device.

Healthcare and manufacturing are paying through the nose

The Change Healthcare incident in 2024 set a new ceiling for what attackers can extract: UnitedHealth confirmed a 22 million USD payment, and total breach cost crossed 2.4 billion USD across remediation, lost revenue, and legal exposure. Affiliates noticed. Coveware's 2025 data shows median payments in healthcare nearly doubled year-over-year, and manufacturing followed close behind, driven by attacks on operational technology environments where downtime costs measured in hundreds of thousands per hour.

If you operate in either sector, your threat model should assume targeted attention from at least one of the major crews within the next 24 months. The defensive priorities that matter most are segmentation between IT and OT networks, immutable backups for the EHR or MES systems specifically, and pre-negotiated relationships with both an IR firm and a negotiator. The time to scout those relationships is the day before you need them.

Pure-extortion attacks are growing faster than encryption

A meaningful and underreported trend in 2025 and 2026 is the rise of data-theft-only extortion. Groups like Karakurt and the Cl0p offshoots are skipping the encryption stage entirely. They breach, exfiltrate sensitive data, and demand payment to suppress publication, without ever touching production systems. This is faster to execute, easier on infrastructure, and harder to detect because there is no encryption event to trigger backups or EDR isolation. Crowdstrike's 2025 Global Threat Report flagged pure-extortion incidents as the fastest-growing subcategory.

The defensive implication is that backup posture, while still necessary, is no longer sufficient. You need data loss prevention controls and outbound traffic monitoring that catch the bulk-export stage. Tools like Microsoft Purview, Varonis, and Netskope all flag unusual exfiltration patterns, but only if you actually tune the policies. Default settings catch obvious smash-and-grab attacks; today's actors are deliberately slow and stealthy, often spreading exfiltration across weeks.

Where Lazarus, Scattered Spider, and state-aligned actors fit

The line between cybercrime and state activity is blurrier every year. North Korea's Lazarus Group continues to use ransomware-style operations as cover for revenue generation, with documented attacks on crypto exchanges and now on traditional banks. Scattered Spider, a loosely affiliated English-speaking crew, executed the MGM Resorts and Caesars attacks using social engineering against helpdesk staff and has been linked to dozens of subsequent incidents. CISA has issued joint advisories with NCSC and the Australian ACSC repeatedly warning about this group's targeting of hospitality and retail.

What this means in practice: the helpdesk is now an attack surface, not a support function. Implement callback verification for any password reset, never push MFA approvals based on a phone call alone, and train support staff to recognize Scattered Spider's specific pretexts. A 15-minute training video and a written verification procedure would have prevented several of the biggest incidents of the last two years.

The defensive playbook that actually moves the needle

After reviewing dozens of post-incident reports, the same five controls show up in every successful defense: phishing-resistant MFA everywhere, including service accounts and admin tools; immutable, offline backups tested monthly with real restoration drills; EDR with active response from Crowdstrike, SentinelOne, or Microsoft Defender for Endpoint deployed on every endpoint and server; aggressive patching of internet-facing devices within 72 hours of vendor disclosure; and network segmentation that limits east-west movement once an attacker is inside.

None of this is novel. None of it is cheap. But the combined cost is consistently lower than the cost of a single serious incident, which the IBM 2025 Cost of a Data Breach Report pegged at 4.88 million USD on average and over 10 million USD in healthcare. The organizations that have stopped attacks in 2025 share a boring pattern: they invested before they had to, they tested their assumptions, and they had a CISO who was empowered to say no to business pressure that compromised the basics.