Ransomware groups shift tactics: data theft instead of encryption

The traditional ransomware model involving malicious encryption of data is declining in prevalence as attackers find it less profitable and more difficult to execute effectively. In 2026, campaigns like PAYLOAD have demonstrated a new approach where attackers compromise Active Directory environments and deploy malicious Group Policy Objects to display ransom demands and lock user access without encrypting data. This method serves as proof of compromise and access to sensitive information. Attackers increasingly focus on stealing confidential data and threatening to publish it, leveraging the risk of reputational damage and regulatory fines under data protection laws. Data exfiltration is stealthier and faster than encryption, making detection and response more challenging. This trend reflects a strategic adaptation by cybercriminals to the widespread adoption of backups and improved ransomware defenses.

This shift in ransomware tactics increases the risk of data breaches and exposure of sensitive information, potentially leading to significant reputational harm and regulatory penalties for affected organizations. Unlike traditional ransomware, which primarily disrupts operations through encryption, these attacks threaten confidentiality and privacy. The use of Active Directory compromise and malicious Group Policy Objects can also disrupt user access and system administration. Detection is more difficult because data exfiltration can blend with normal network traffic, increasing the likelihood of prolonged undetected intrusions.

No official patch is applicable as this is a tactic rather than a software vulnerability. Organizations should implement strong cyber hygiene practices including: regular automatic backups stored on multiple media types; prompt application of patches and updates to reduce vulnerability exposure; deployment of multi-factor authentication and endpoint security solutions; use of SIEM or EDR tools for enhanced visibility and rapid incident response; regular monitoring of external infrastructure for exposed services; strict adherence to the principle of least privilege; and ongoing staff training to reduce phishing and social engineering risks. These measures collectively reduce the risk and impact of extortion schemes that do not rely on encryption.