From Cipher to Fear: The psychology behind modern ransomware extortion

This report analyzes how ransomware operations reorganized in 2025 from encryption-focused incidents into large-scale, pressure-first extortion campaigns that weaponize stolen data, legal/regulatory exposure, and psychological coercion; it highlights examples (SafePay, Cl0p, MongoDB campaigns), victim patterns (SMBs in high-regulation regions), attacker techniques (supply-chain exfiltration, misconfiguration scanning, leak-site reuse), and prescribes defensive shifts including legal/communications readiness, prioritized vulnerability and configuration remediation, and external exposure monitoring.