THREAT OPS › Threat News › Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape
<div class="block-paragraph_advanced"><p>Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark</p> <hr /></div> <div class="block-paragraph_advanced"><h3><span style="vertical-align: baseline;">Introduction</span><strong style="vertical-align: baseline;"> </strong></h3> <p><span style="vertical-align: baseline;">Since 2018, when many financially motivated threat ac
Attributed threat actors
- Indrik SpiderG0119
- Earth LuscaG1006
- AkiraG1024
- INC RansomG1032
MITRE ATT&CK techniques
- Scheduled TaskT1053.005
- Windows Management InstrumentationT1047
- SharepointT1213.002
- Artificial IntelligenceT1588.007
- JavaScriptT1059.007
- MalvertisingT1583.008
- Security Account ManagerT1003.002
- Windows ServiceT1543.003
- VulnerabilitiesT1588.006
- Password ManagersT1555.005
- Remote Access ToolsT1219
- Social EngineeringT1684
- MasqueradingT1036
- Rogue Domain ControllerT1207
- Windows Remote ManagementT1021.006
- Cloud ServicesT1021.007
- PowerShellT1059.001
- CredentialsT1589.001
- Windows Credential ManagerT1555.004
- Remote Desktop ProtocolT1021.001
- KerberoastingT1558.003
- CompressionT1027.015
- Software ToolsAML.T0016.001
- MasqueradingAML.T0074
Indicators of compromise
- ff67c703589f775db9aed5a03e4489b0md5
- CVE-2024-55591cve
- CVE-2024-21762cve
- CVE-2019-6693cve
- CVE-2024-40766cve
- CVE-2024-3400cve
- CVE-2023-4966cve
- CVE-2025-53770cve
- CVE-2025-53771cve
- CVE-2025-8088cve
- CVE-2025-61882cve
- CVE-2021-27877cve
- CVE-2021-27878cve
- CVE-2021-40539cve
- CVE-2025-31324cve
- CVE-2025-31161cve
- CVE-2024-37085cve
- https://www.coveware.com/blog/2026/2/3/mass-data-exfiltration-campaigns-lose-their-edge-in-q4-2025#paymentsurl
- https://www.coveware.com/blog/2026/2/3/mass-data-exfiltration-campaigns-lose-their-edge-in-q4-2025url
- https://assets.sophos.com/X24WTUEQ/at/9brgj5n44hqvgsp5f5bqcps/sophos-state-of-ransomware-2025.pdfurl
- https://www.paloaltonetworks.com/engage/unit42-2025-global-incident-response-reporturl
- https://www.europol.europa.eu/media-press/newsroom/news/largest-ever-operation-against-botnets-hits-dropper-malware-ecosystemurl
- www.torproject.orgdomain