The Shift in Ransomware Strategy

Coveware’s recent insights reveal a notable evolution in ransomware attacks, with large organizations now bearing the brunt of complex, high-demand threats. Meanwhile, smaller businesses remain vulnerable to numerous lower-demand attacks. This more frequent targeting increases the chance of compliance with ransom demands, albeit for smaller amounts. Larger enterprises are becoming increasingly wary of succumbing to these ransoms, fully aware that cooperation might not always guarantee a positive outcome. As the trend of paying off attackers dwindles, a possibility looms that offenders will refine their strategies to prey on financially resilient entities.

The data speaks volumes—average and median ransom payments have shown a massive decrease, plunging by 66% and 65% respectively in Q3 2025. Back in early 2019, a whopping 85% of victims paid ransoms, but that number has now plummeted to just 23%. With the decline in ransom payments, attackers may adapt to more resourceful measures.

Evolution of Attack Techniques

Attack strategies have dramatically evolved, moving away from simple file encryption to the more menacing double extortion tactics. Now, attackers steal data before encrypting it. This shift means businesses might have backups for restoration, but the looming threat of data exposure compels them to pay ransoms to safeguard their reputations. In Q3 2025, data theft was a component of 76% of the attacks, and some perpetrators have entirely shifted to data theft without bothering with encryption. This pure extortion tactic results in a lower ransom payment rate of 19%, reflecting victims’ skepticism regarding the safekeeping of their data post-payment.

Incidentally, methods of gaining initial access have also transformed. While previously phishing and social engineering reigned supreme, there’s a marked rise in compromised remote access cases, now representing almost half of all breaches. Phishing has dropped to around 18%, with remote access exploitation often combining various deceitful techniques to infiltrate networks.

Prominent Threat Groups and Target Sectors

Among the dominant threats, Akira and Qilin have surfaced as leading ransomware groups, orchestrating 34% and 10% of attacks, respectively. Their focus on high-volume, smaller-payout demands possibly points towards a shift away from heavily-secured larger networks. Moreover, there are alarming reports of insider collusion, where employees are bribed for access.

On the target landscape, the healthcare sector, while still vulnerable, accounted for only 9.7% of attacks, sharing this ranking with the software services field. The professional services sector encountered the highest amount of attacks, with 17.5% of the Q3 attempts targeting them, underscoring an urgent need for robust defense systems across various industries to counter this escalating threat.

For more insights on preventing ransomware attacks and protecting your business’s digital assets, consider making a free account with Qsentinel. Stay vigilant and safeguard your data.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.