As cited
Copy frozen at (site build).
ransomware
Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report
The Zscaler ThreatLabz 2026 Ransomware Report analyzed ransomware activity from April 2025 through March 2026 and found that while victim counts remained relatively flat, attackers are stealing massive volumes of data: the top 10 groups by leak volume increased exfiltration by 275.8% year over year to 896.2 terabytes. Threat actors are increasingly targeting business employees in finance, sales, operations, and management roles through social engineering via trusted tools like Microsoft Teams and remote access utilities, then using that access for reconnaissance, lateral movement, and data theft. Total ransom payments declined 15.8% but average payments rose 5.3% to $431,995, reflecting attackers' focus on extracting maximum value from each victim rather than volume.
Why it matters: Security teams must prioritize detecting and blocking data exfiltration and lateral movement as primary attack objectives, strengthen controls around remote access and collaboration tools, and apply behavioral detection to threat tactics rather than relying only on group attribution, since 60% of the top 15 ransomware groups by victim volume are new actors using similar techniques.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ransomware
Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report
The Zscaler ThreatLabz 2026 Ransomware Report analyzed ransomware activity from April 2025 through March 2026 and found that while victim counts remained relatively flat, attackers are stealing massive volumes of data: the top 10 groups by leak volume increased exfiltration by 275.8% year over year to 896.2 terabytes. Threat actors are increasingly targeting business employees in finance, sales, operations, and management roles through social engineering via trusted tools like Microsoft Teams and remote access utilities, then using that access for reconnaissance, lateral movement, and data theft. Total ransom payments declined 15.8% but average payments rose 5.3% to $431,995, reflecting attackers' focus on extracting maximum value from each victim rather than volume.
Why it matters: Security teams must prioritize detecting and blocking data exfiltration and lateral movement as primary attack objectives, strengthen controls around remote access and collaboration tools, and apply behavioral detection to threat tactics rather than relying only on group attribution, since 60% of the top 15 ransomware groups by victim volume are new actors using similar techniques.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ransomware
Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report
The Zscaler ThreatLabz 2026 Ransomware Report analyzed ransomware activity from April 2025 through March 2026 and found that while victim counts remained relatively flat, attackers are stealing massive volumes of data: the top 10 groups by leak volume increased exfiltration by 275.8% year over year to 896.2 terabytes. Threat actors are increasingly targeting business employees in finance, sales, operations, and management roles through social engineering via trusted tools like Microsoft Teams and remote access utilities, then using that access for reconnaissance, lateral movement, and data theft. Total ransom payments declined 15.8% but average payments rose 5.3% to $431,995, reflecting attackers' focus on extracting maximum value from each victim rather than volume.
Why it matters: Security teams must prioritize detecting and blocking data exfiltration and lateral movement as primary attack objectives, strengthen controls around remote access and collaboration tools, and apply behavioral detection to threat tactics rather than relying only on group attribution, since 60% of the top 15 ransomware groups by victim volume are new actors using similar techniques.
- Source published
- First seen by Cybersecurity Tracker