Posts by Raymond Umerley

An employee takes a call from a friendly voice claiming to be internal IT. The caller is following up on an issue and finishing it should only take a few minutes. The employee cannot recall opening a ticket, and with work waiting, they download the “help tool” as instructed, approve remote access to the computer, and get back to what they were doing. The whole thing is forgotten by lunch. Read more

For years, ransomware incidents were interpreted through a familiar set of signals. Leaders identified the malware family, mapped it to the threat group, assessed the demand, and used those inputs to judge the scale of the event and how to respond. The approach was never precise, but it gave executives a practical shorthand for framing risk quickly. Read more

Many organizations still understand cyber extortion primarily as a malware problem. Ransomware encrypts files, systems go offline, and a ransom demand forces a crisis response. That sequence still exists, but it does not fully explain many of the highest-impact incidents of 2025. Drawing on hundreds of engagements, Coveware by Veeam observed that initial access and attacker leverage increasingly shift toward people, process, and identity, with targeted social engineering emerging as a defining entry pattern. In many of these cases, the intrusion began well before ransomware entered the picture, and no threat actor group illustrates that shift more clearly than Scattered Spider.  Read more

Ransomware isn’t new, but the way attackers gain access keeps evolving. In 2025, human‑targeted tactics and cloud‑based compromise dominate the threat landscape. Phishing emails are only the beginning; today’s campaigns extend through chat platforms, voice calls, and even trusted SaaS integrations. The goal is simple: find one person, one credential, or one misconfigured service that opens the door. Read more

Remote access is the backbone of modern business. Employees log in from home and on the road, vendors and contractors need entry points to keep services running, and IT teams depend on remote tools to manage sprawling hybrid environments. In short, organizations can’t function without it. Read more

Coveware by Veeam experts have observed a sharp rise in Akira ransomware cases, with more than 40 of those incidents tied to a single exploitation pathway. At the center of these cases is a recently mitigated VPN vulnerability in widely deployed enterprise appliances, which Akira has been actively exploiting to gain initial access. What makes this surge particularly concerning is that many of the victim organizations had already applied the vendor’s patch. Read more

It starts like any other morning — except for the IT admin, who logs in first. You check the monitoring dashboard and see a few alerts: elevated CPU usage, a couple of failed logins, then a string of disconnected endpoints. At first, it looks like routine noise. Maybe a patch failed overnight. Maybe a script hung. Read more

Purpose-Built Expertise for Ransomware and Cyber Extortion

Ransomware and cyber extortion are more than security incidents; they are full-scale business crises. When operations halt and leadership demands answers, you need more than generalist DFIR. You need a partner fluent in high-stakes ransomware extortion.

Coveware by Veeam offers a dedicated Incident Response Retainer focused exclusively on ransomware and cyber extortion. Built to strengthen preparedness before an incident and accelerate response during one, Coveware reduces downtime, lowers costs, and restores clarity and control when it matters most.

Why Coveware? Strategic Value from Day One

A Partner Committed to Avoiding Payment

Our foundational principle: If you can avoid paying, you should.

Coveware builds recovery confidence so clients can walk away. When payment is unavoidable, we shorten timelines, cut ransom ... Read more

We’re happy to share Veeam’s new report — From Risk to Resilience: 2025 Ransomware Trends and Proactive Strategies. Read more

Akira ransomware has cemented its reputation as one of the most relentless and disruptive cyber threats affecting organizations today. Read more