Less Lucrative Ransomware Market Makes Attackers Alter Methods

GTIG's 2025 analysis finds ransomware actors increasingly exfiltrate data (≈77% of incidents), target virtualization infrastructure (≈43%), and use vulnerability exploitation (~33%) and stolen credentials for access; attackers are shifting away from external tooling (Cobalt Strike down to 2%) toward native Windows utilities (PowerShell, WMI, RDP used in ~85%) to evade detection, while ransom payment frequency declines amid improved defenses and law enforcement action.