The third quarter of 2026 reinforced a decisive shift in the threat environment: ransomware is increasingly shedding the “ware” in favor of pure, low-friction data extortion. Nowhere was this clearer than in the recent high-profile leak of internal chat logs belonging to the Silent Ransom Group. The leaked communications revealed threat actors who have largely abandoned network-wide encryption binaries in favor of direct cloud and SaaS exfiltration, aggressive social engineering, and targeted physical insider attacks. By removing the costly, labor-intensive deployment of ransomware encryption, groups like Silent Ransom Group can execute rapid breach-and-extort operations that bypass traditional endpoint defenses while maintaining leverage over victims. Read more

In February of 2024, a consortium of law enforcement agencies took down LockBit ransomware group. The discovery that LockBit retained victims’ stolen data despite promises to delete it demonstrates a critical flaw in the advice often given to ransomware victims. At the time, many legal and incident response professionals recommended payment on the assumption that LockBit had a strong financial incentive to honor its commitments and that the likelihood of data being publicly released after payment was relatively low. While that assessment may have appeared reasonable based on short-term observed outcomes, it relied heavily on assumptions about the behavior of a criminal enterprise that could never be independently verified. Read more