Google Warns Ransomware Actors Are Shifting Tactics as Profits Fall and Data Theft Rises

GTIG’s 2025 analysis reports a shifting ransomware ecosystem: ransom payments and demands fell, but operators adapted by increasing data theft (observed in ~77% of intrusions) and leveraging exfiltration tools like Rclone and cloud storage to extort victims. REDBIKE became the most prevalent ransomware family (~30% of incidents), RaaS disruptions allowed new actors to emerge, and attackers shifted focus to smaller, less-defended organizations; the report recommends DLP, outbound monitoring, endpoint hardening, and recovery preparedness.