FOCUS
Ransomware
The defining cybercrime of the decade. How it works, who runs it, and where the money goes.
Ransomware is the defining cybercrime of the decade. This section covers how attacks actually work, the ransomware-as-a-service economy that industrialised them, profiles of the major operators, and the hard numbers behind the headlines. Start with the plain-English guide to what ransomware is, then how double extortion works and how RaaS turned it into a franchise model.
For live and verified data rather than operator claims, use the Ransomtracker for active leak sites, the confirmed ransomware statistics updated monthly, the confirmed attacks index by sector, country and year, and the ransomware payment rate analysis.
Start here
- What is ransomware? A plain-English guide
- What is RaaS? Ransomware-as-a-service, explained
- What is double extortion ransomware?
- Ransomware statistics 2026: confirmed attacks by month
- Ransomware incident response runbook
- Is it illegal to pay a ransomware ransom?
Latest ransomware coverage
- Confirmed ransomware attacks, October 2026: 25 verified so far, Everest and The Gentlemen lead
Ransomnews has confirmed 25 ransomware attacks for October 2026 so far. Everest and The Gentlemen lead with three victims each, government is the most-hit sector, and in 11 of 19 listed cases the gang went public before the victim. - Confirmed ransomware attacks, September 2026: 55 verified so far, Qilin and The Gentlemen leadRansomnews has confirmed 55 ransomware attacks in September 2026, against 107 in August and 151 a year earlier. Provisional. Government led the sectors, Qilin and The Gentlemen the groups.
- Is it illegal to pay a ransomware ransom in 2026?Paying a ransomware ransom is usually legal, but sanctions can make it a crime, and 2026 rules are tightening fast. The law in the US, UK, EU and Australia, and what paying still does not buy.
- Confirmed ransomware attacks, August 2026: 51 verified so far, Qilin leadsRansomnews confirmed 51 ransomware attacks in August 2026, down from 62 in July and 136 a year earlier. Qilin led with nine victims and government was the most affected sector.
- ESXi ransomware in 2026: one host, the whole datacenter
ESXi ransomware encrypts every VM on a hypervisor at once. Here is why VMware ESXi became ransomware’s highest-value target in 2026, and how to defend it. - MSPs: ransomware’s #1 target of 2026 [Field Report]
Managed service providers entered 2026 as the single highest-leverage target class in the ransomware economy. Why the channel is now the front line, which TTPs operators are running against MSPs specifically, and what the better-run shops have already changed. - Ransomware attribution 2026: TTPs, notes, fingerprintsA 2026 attribution playbook for ransomware investigations, combining TTP fingerprinting against MITRE ATT&CK, ransom-note artifact analysis, leak-site monitoring, and the open-source intelligence pivots that hold up under scrutiny.
- Ransomware IR runbook 2026: NIST 800-61 r3 + CISA templatesA practitioner walkthrough of building a ransomware-specific incident response runbook in 2026, combining NIST SP 800-61 r3, CISA’s #StopRansomware playbook, and the lessons from named incidents on the Ransomtracker leak feed.
- What is double extortion ransomware? An explainer for non-technical executives in 2026An executive-level explainer of double extortion (the dominant ransomware playbook in 2026) covering how it works, why backups don’t fully defeat it, and the policy choices boards now have to make in the first hour of an incident.
- How stealer logs power modern ransomware attacksA dollar-per-log credential-theft economy now feeds the multi-million-dollar ransomware economy. The pipeline from a teenager’s pirated game download to enterprise extortion is shorter than most security teams realise.
- What is ransomware? A plain-English guide to how it works, who it hits and what it costsRansomware is malware that locks organisations out of their data and demands payment, and in its modern form steals the data first. What it is, how an attack unfolds, who gets hit, what it costs and why fewer victims pay, with live figures from 9,500 confirmed attacks.
Every ransomware article
Every article we have published in this section, newest first.
- Confirmed ransomware attacks, September 2026: 55 verified so far, Qilin and The Gentlemen lead
- Is it illegal to pay a ransomware ransom in 2026?
- Medusa ransomware: victims, tactics, and how to defend in 2026
- Confirmed ransomware attacks, August 2026: 51 verified so far, Qilin leads
- What is intermittent encryption? A 2026 guide
- What is BYOVD? Bring your own vulnerable driver, explained
- Interlock: the drive-by ransomware crew CISA flagged
- SafePay: the centralised crew that skipped affiliates
- INC Ransom: the RaaS that wins by mastering the basics
- Deadlock: ransomware that hides its C2 on the blockchain
- DragonForce: the cartel that absorbed its rivals
- LockBit 5.0: the comeback nobody wanted
- Akira: the edge-VPN ransomware that never slowed down
- Qilin: the RaaS that ran H1 2026 ransomware
- ESXi ransomware in 2026: one host, the whole datacenter
- The Gentlemen ransomware: 483 victims and a leaked playbook
- Ransomware runs office hours: what 16,699 leak posts reveal
- 62% of database ransom wallets were never paid
- Ransomware ditched encryption in May 2026: here’s why
- Initial Access Brokers 2026: ransomware’s supply chain
- MSPs: ransomware’s #1 target of 2026 [Field Report]
- Ransomware attribution 2026: TTPs, notes, fingerprints
- Ransomware IR runbook 2026: NIST 800-61 r3 + CISA templates
- What is double extortion ransomware? An explainer for non-technical executives in 2026
- How stealer logs power modern ransomware attacks
- What is ransomware? A plain-English guide to how it works, who it hits and what it costs