A leak site that goes quiet for a few weeks usually isn't a sign the crew retired. More often the brand died, the affiliates scattered, and a new domain with a fresh logo is already collecting victims somewhere else. That pattern — churn on the surface, continuity underneath — defined much of the past year in ransomware, and it shapes what defenders should expect next.
The Affiliate Model Kept Reshuffling the Deck
Ransomware stopped looking like a handful of crime syndicates a while ago. A core group builds the encryptor, runs the leak site and handles negotiations. Affiliates break into networks and take a cut. When a big brand collapses — through an exit scam, an arrest or a seizure — the affiliates don't stop working. They emigrate.
LockBit is the clearest example. After law enforcement dismantled its infrastructure in early 2024, its share of listings collapsed. Akira, Qilin, RansomHub, Play and Hunters International absorbed much of the displaced talent, and some of those names turned up on victim pages that previously carried LockBit's branding. ALPHV/BlackCat followed a different route: affiliates claimed a massive payment tied to a healthcare outage, then the core group vanished with the money and left its partners holding stolen data they couldn't monetise. Those partners moved on within days.
The practical lesson hasn't changed. Tracking group names is useful for reporting, less useful for defence. The tools are similar, the entry points are similar, and the negotiators often rotate between brands. Build your controls around techniques, not logos.
Takedowns and Sanctions Bite Slowly
Law enforcement kept up the pressure. Seizures of dark web infrastructure, arrests of alleged operators and affiliates across Europe and Asia, sanctions targeting cryptocurrency services used to move payouts, and coordinated actions against the malware loaders that ransomware crews rent. Investigators also did something more useful for defenders: publishing decryption keys and mirroring seized victim data so extortion lost its leverage.
The honest caveat is timing. A takedown disrupts a group for weeks or months, not permanently. It also creates a vacuum that another crew fills, sometimes within days. The realistic benefit is narrower but real: it raises the cost of operating, forces rebranding, and produces intelligence — indicators, chat logs, crypto trails — that defenders and responders can actually use.
Encryption Became Optional
Plenty of the year's worst incidents involved no encryption at all. Attackers stole data, then leaned on pressure alone: emails to executives, phone calls to staff, threats to notify regulators, customers or journalists. Some groups opened a second front by contacting the victim's clients directly, and a few filed complaints with regulators themselves when a company refused to pay.
This matters because encryption is what most incident response plans are built around. If nobody locks your files, your detection triggers may never fire. A quiet exfiltration of a few hundred gigabytes from a file server or a software-as-a-service tenant can look like ordinary business traffic for weeks.
Edge Devices and File Transfer Tools Stayed the Favourite Door
Initial access kept coming from the unglamorous places. Exposed VPN appliances, firewalls and virtualisation hosts. Remote monitoring and management tools. File transfer software used by finance and healthcare partners. Credentials bought from infostealer logs and reused on accounts that never got multi-factor authentication.
The common thread is convenience. An attacker who exploits an internet-facing appliance doesn't need a phishing campaign at all. The window between a vendor advisory and active exploitation is often measured in hours, which is why patch cadence on perimeter gear is now a board-level risk rather than a sysadmin chore.
How to Read a Leak Site Like a Professional
If you follow this space, a few basics will save you from bad conclusions. Most leak sites follow a recognisable structure:
- Company listing: sector, size hint, sometimes a country flag, and a claimed amount of stolen data.
- Sample files: screenshots, contracts, payroll sheets or ID scans used as proof. Real dumps usually include a small, verifiable selection.
- Countdown timer: an extension or expiry date that is often theatre. Timers get reset when negotiations continue.
- Status labels: "published", "sold" or simply deleted. A deleted listing can mean payment, a law enforcement seizure, or a crew that folded.
- Mirrors: multiple onion addresses. If one goes offline, the operation is probably still alive elsewhere.
- Negotiation chat leaks: posted to humiliate victims, and a rich source of detail about tactics and pricing.
Two habits are worth building. First, check mirror activity rather than a single address before drawing conclusions. Second, treat every listing as unverified. Some groups inflate data volumes, and copycat posts intended to embarrass a company do happen.
What to Watch Next
Several trends look likely to continue or accelerate:
- Consolidation under fewer names. Expect a smaller number of dominant brands, with individual brand lifetimes measured in months rather than years.
- Pure data extortion as the default. Encryption becomes a negotiation prop rather than the main event.
- More pressure on customers and employees through direct calls, emails and regulatory complaints.
- Identity attacks at help desks. Voice phishing and MFA registration abuse to reset credentials legitimately.
- Faster exploitation of edge devices, often within a day or two of a public advisory.
- Affiliate arrests and infrastructure sanctions continuing, with occasional large seizures.
- More non-Windows targets: hypervisors, network storage and Linux servers, where security tooling is thinner.
A Practical Playbook for the Next 12 Months
None of this requires a new budget line. It requires priorities.
Start with backups you have actually restored from, kept offline or immutable, with credentials that don't live in the same directory as everything else. Then inventory every internet-facing device and assign someone to patch it within a defined window — measure it, don't assume it. Move to phishing-resistant MFA for administrators, remote access and email, and alert on new MFA registrations. Restrict who can mass-read file shares, and log it when they do.
Rehearse a data-theft scenario, not just a locked-files scenario. Decide in advance who speaks to the attackers, who briefs customers, who talks to regulators, and how you prove what was taken. Retain outside counsel and an incident response firm before you need them, because the first four hours set the tone for everything after.
And keep the legal side in view. Disclosure requirements and the treatment of ransom payments differ by jurisdiction and change over time, so get qualified legal advice early rather than relying on what worked for someone else last year. Paying is also no guarantee of silence: a crew can take the money and leak anyway, a law enforcement seizure can publish the data for you, and an exit scam can leave your files on a dead site with nobody left to negotiate with.
The groups will keep changing names. The fundamentals — access, exfiltration, pressure — won't. Defenders who plan for the second one are the ones who sleep better.
Photo: peterweideman / Pixabay