Blog

The third quarter of 2026 reinforced a decisive shift in the threat environment: ransomware is increasingly shedding the “ware” in favor of pure, low-friction data extortion. Nowhere was this clearer than in the recent high-profile leak of internal chat logs belonging to the Silent Ransom Group. The leaked communications revealed threat actors who have largely abandoned network-wide encryption binaries in favor of direct cloud and SaaS exfiltration, aggressive social engineering, and targeted physical insider attacks. By removing the costly, labor-intensive deployment of ransomware encryption, groups like Silent Ransom Group can execute rapid breach-and-extort operations that bypass traditional endpoint defenses while maintaining leverage over victims.

This pivot toward pure data exfiltration is reflected across the Q3 2026 metrics. All figures below are from incidents Coveware by Veeam supported in Q3 2026. As threat actors refine these tactics, victims are increasingly confronting extortion demands rooted solely in stolen data rather than operational downtime. However, this strategy is meeting growing resistance. Victim organizations are recognizing that paying for non-disclosure offers little guarantee against repeat extortion or eventual data leaks, leading to a noticeable recalibration in settlement behaviors. As we discussed last quarter, outlier events occur more frequently than even the best advisors can forecast. The Silent Ransom Group chat leak is a case in point: it identified several victims that had paid a ransom to keep their incident out of the public domain.

Ransom Payments By Quarter

While the median ransom payment climbed to $400,000, a 167% increase compared to Q2 2026, the average ransom payment dropped 45% to $1,025,278. This narrowing spread points to a bifurcated market: while opportunistic actors attempt to squeeze mid-market organizations with higher baseline demands, larger enterprises are proving more resilient and less willing to pay multimillion-dollar extortions when system availability is not compromised.

Actor dynamics shifted as well, with pure-exfiltration and rogue affiliate models rapidly gaining market share. In Q3, the cyber threat landscape was defined by extreme fragmentation and volatility, proving that focusing on specific threat actor names is a losing strategy. No single group dominated with top actors like The Gentlemen and independent “Lone Wolves” accounting for just 6% of cases each, while groups like Inc Ransom, FulcrumSec, and Qilin rapidly surged into the rankings. Once inside, attackers are heavily utilizing exfiltration-led extortion, weaponizing stolen data to generate severe regulatory and reputational pressure.

Ransomware Group Market Share in Q3 2026

Ransom Payment Rates in Q3 2026

In Q3 2026, both overall ransomware payment rates and pure data exfiltration (DXF) payment rates experienced slight upticks compared to the previous quarter. Historically, these modest increases remain well within the typical range of quarter-to-quarter variance. Rather than signaling a reversal or the start of a new upward trend, payment rates continue to fluctuate near historic lows. Organizations remain largely resilient, with the vast majority choosing not to concede to extortion demands. When operations can be restored and the only thing on offer is an unverifiable promise to delete stolen data, the decision to pay becomes a legal and regulatory question rather than a survival question, and most victims are answering no. 

While DXF remains a highly scalable, low-effort extortion model for threat actors, nearly 80% of incidents are resolved without a ransom payment. For executives, this low payment rate reflects the limited utility of yielding to demands: paying rarely alleviates regulatory or legal notification obligations, and threat actors’ promises to delete stolen data cannot be verified. Because post-payment risks like data resale or re-extortion persist, leaders must treat DXF-only attacks primarily as legal, governance, and communications crises rather than technical events.

Given the historical downward trend of data-exfiltration-only rates and the Silent Ransom Group leak, we anticipate some ransomware groups may revert to simpler impact tactics that yield more predictable, less volatile outcomes. As the Silent Ransom Group chat leak demonstrates, cyber extortion has evolved into an exercise in reputational and regulatory leverage, where understanding how unreliable data exfiltration actors are is critical to navigating an incident.

Initial Access Vectors in Q3 2026

In Q3, the initial access landscape demonstrated that threat actors heavily favor low-friction, identity-based methods over complex, noisy exploits. Rather than forcing their way in, attackers are finding credible paths through trusted access. Phishing and social engineering led all observed vectors at approximately 29%, followed by steady rates of remote access compromise (22–23%) and a clear quarter-over-quarter rise in compromised credentials (14–15%). While the exploitation of unpatched software appliances and edge devices saw a modest increase (11–12%), identity and access abuse collectively dominate the threat picture. Because these intrusions so closely resemble legitimate user activity, attackers can move swiftly and quietly from initial access directly into SaaS environments, cloud repositories, and sensitive databases to execute rapid data exfiltration.

The takeaway is clear: defending the organization requires scrutinizing trusted access paths. Because modern attacks look like normal logins, security teams must move beyond simple authentication. Defenses must be built to continuously validate the user, the device, and the context or purpose of the access before trusting the connection.

Most Common Tactics, Techniques, and Procedures in Q3 2026

In Q3 2026, threat actors continued to rely heavily on identity compromise and legitimate administrative tools to navigate and control victim environments. With Lateral Movement (71%) tied with Data Exfiltration as the most frequently observed tactic, navigating the network undetected remains the operational backbone of hands-on-keyboard intrusions. Attackers frequently abuse compromised identities (Credential Access, 56%) to use legitimate paths like RDP, SMB, and remote monitoring platforms. Because this activity, along with Command and Control (44%), closely mimics routine administrative tasks, rapidly identifying and containing east-west movement requires coordinated timing. Isolated technical actions to disrupt control channels can inadvertently prompt attackers to switch tools or accelerate their timelines, making unified oversight essential.

Once attackers have a foothold, their objectives are leverage and business disruption. Data Exfiltration (71%) is no longer simply a precursor to encryption; it serves as a primary driver of extortion, using standard web services and cloud storage to blend into routine network traffic. Simultaneously, Impact, the stage where unauthorized access turns into operational disruption such as encryption or service interruption, rose to 50% of cases, a notable increase from Q2 2026. The move to operational impact compresses decision timelines for leadership and elevates technical incidents into enterprise-wide crises.

For executives, this threat environment demands a response strategy that treats incidents as business-critical decisions rather than purely technical problems. Suspected data theft introduces immediate legal, regulatory, and reputational consequences, while rising operational impacts require pre-planned recovery. Effective resilience now depends on three things: clear isolation authority, verified identity systems during containment, and recovery operations coordinated across the organization. That coordination includes secure administrative access to backups and strict rebuild priorities. Data that has already left the network cannot be recovered, but an organization that can rebuild on its own terms removes the attacker’s strongest lever and turns a data-theft demand into a decision it can make deliberately rather than under duress.

Industries Impacted by Ransomware in Q3 2026

No sector was immune in Q3, but threat actors gravitated toward organizations with high data sensitivity or low tolerance for operational disruption. Professional and legal services, healthcare, financial institutions, and manufacturing continued to represent significant shares of overall victim volume. This spread highlights the dual-pronged pressure tactics used by modern cyber extortionists: while manufacturing and operational technology sectors are vulnerable to downtime threats, service-oriented and healthcare sectors face extreme regulatory, legal, and reputational pressure when client or patient records are exfiltrated. Pure data extortion campaigns have proven particularly effective against mid-market firms in highly regulated industries where data exposure carries strict reporting requirements and compliance penalties.

Victim Organizations by Company Size in Q3 2026

Median company size:

1,121 employees (+49% from Q2 2026)

Mid-market companies continue to bear the brunt of volume-driven cyber extortion campaigns. In Q3 2026, the median company size rose to 1,121 employees, a 49% increase from Q2 2026, indicating that threat actors are moving up-market for larger payouts without taking on the hardened security postures of global enterprises. Mid-sized organizations represent an ideal middle ground for attackers: large enough to possess valuable customer data, intellectual property, and accessible capital, yet often constrained by lean security teams and hybrid IT environments that are harder to monitor.

An Open Letter to Senior Partners at Law Firms

Before we close, we would like to take a detour into a messaging mode we are loath to use: Fear, Uncertainty, and Doubt (FUD). If you work at a law firm, especially if you are a senior partner, please pay close attention. If you are not a senior partner at a law firm, please send this to any senior partner you know.

Dear senior partners at law firms,

YOU are being actively targeted as you read this. Several ransomware groups are working to find a weakness that will successfully trick YOU personally into creating a data breach. These groups are NOT using sophisticated technical methods to hack through your firewall or exploit a software vulnerability in the security perimeter. The data on YOUR personal computer will not be the end of the attack chain. YOU personally and your laptop are the entire attack chain.

These threat actors are studying your “people/profile” page on your firm’s website. That page is candy for them, as it hands over your email and direct phone number to the threat actors. It also lists all sorts of great information about you and your practice. Threat actors are going to use all this free intelligence about you to craft a bespoke voice-phishing (vishing) campaign against you. They are going to email you, they are going to call you directly, and it will be hard to tell legitimate contact from their social engineering. Unfortunately, you are likely to make a mistake that they will quickly capitalize on. You, and you alone, may be responsible for creating a data breach that irreparably damages the brand of your firm and the reputation of all of your partners. You had the opportunity to get serious about this risk, and the window is closing.

By the time this campaign winds down, we forecast that the majority of the Am Law 100 will have been impacted. It is that pervasive. It is that serious. We HATE using FUD messaging and almost never do. In this case, the risk justifies it. Take it seriously. Only the paranoid will survive.

Read Cyber Extortion Review for the complete data set and analysis.

The post The Silent Ransom Group Leak Shows Why Paying for Silence Fails appeared first on Veeam Software Official Blog.

from Veeam Software Official Blog https://ift.tt/OREetUM