Ransomware crews investing in custom data stealing malware

Cisco Talos reviewed the top 14 ransomware groups and found a shift toward bespoke data-exfiltration tools, increased use of infostealers and credential theft, and emphasis on defense-evasion to extend dwell time; notable examples include BlackByte's Exbyte and LockBit's StealBit, and high-profile double-extortion incidents against organisations such as Synnovis and Christie's illustrate real-world impact.