Ransomware-driven data exfiltration: techniques and implications

This report analyzes the increasing centrality of data exfiltration in ransomware and extortion operations since 2019, detailing motivations behind double extortion, the prioritization and triage of high-value datasets, and the mix of custom, commodity, and legitimate tools used to stealthily collect and transfer data. It notes occasional use of infostealers and MaaS, emphasizes the prevalence of publicly available utilities to blend with normal activity, and recommends early, multi-method detection focused on suspicious behaviors, access patterns, and known exfiltration tooling.