New ransomware tactics to watch out for in 2026

This report outlines ransomware trends in 2025 showing reduced ransom revenues despite a 47% rise in publicly reported attacks, driving shifts in tactics: re-bundling DDoS within RaaS programs, accelerating insider recruitment (notably via native English speakers), and exploiting gig platforms for unwitting physical access. It forecasts that 2026 will be the first year new ransomware actors outside Russia outnumber those within, signaling the ecosystem’s globalization. Recommended defenses include bolstered DDoS mitigation aligned to ransomware events, strengthened insider threat programs and monitoring, and tighter physical verification procedures for on-site IT activities.