Back Technadu

Ransomware State: Encryptionless Extortion, Post-Quantum Cryptography, EDR Killers

Technadu • May 12, 2026

Kaspersky’s "State of Ransomware in 2026" report details that while the of organizations affected by ransomware decreased across all regions in 2025 compared to 2024, the malware remains a major enterprise threat.

Threat actors are rapidly refining their intrusion methodologies, increasingly deploying EDR killers and Bring Your Own Vulnerable Driver ( BYOVD ) techniques to disable endpoint defenses.

The contemporary threat landscape is currently witnessing the deployment of post-quantum cryptography. The new PE32 ransomware family utilizes the cutting-edge ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) standard to secure its AES keys, the report said .

NIST recently selected this cryptographic framework as the primary standard for post-quantum defense. Simultaneously, malicious groups are shifting toward encryptionless extortion.

As global ransom payment rates dropped to 28% in 2025, according to Chainalysis, threat actors like ShinyHunters are abandoning file encryption in favor of data theft and extortion via public leaks.

Furthermore, the industrialization of attacks relies heavily on initial access brokers (IABs), who continue to exploit RDP, VPN, and RDWeb as their leading network access vectors. This Access-as-a-Service model is fueled by “ credential theft operations, and the widespread availability of compromised accounts harvested through infostealers and phishing campaigns. ”

Qilin operated as the most active targeted ransomware group in 2025. Other major active operators included Cl0p Ransomware and Akira, while RansomHub experienced a rapid operational rise and subsequent disappearance.

DragonForce and emerging actors like The Gentlemen continue to professionalize data-centric extortion workflows. Some other groups to take note of in 2026:

In response to this activity, global law enforcement agencies escalated infrastructure disruptions, seizing prominent dark web platforms RAMP and LeakBase in 2026. These takedowns follow prior operational successes that seized Nulled, Cracked, XSS, and the official data leak sites of BlackSuit and 8Base.

A December 2025 report outlined that modern Akira, Qilin, and Medusa Ransomware cyberattacks use Shanya Packer-as-a-Service (VX Crypt). Last month, Qilin claimed a cyberattack on the German Democratic Socialist Party, Die Linke.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Evolution: Encryptionless Extortion and EDR Bypass Tactics Rise Kaspersky's 2026 report indicates a decline in ransomware incidents, yet the threat remains significant. Attackers are increasingly using EDR killers and BYOVD techniques to bypass security measures. The PE32 ransomware family employs post-quantum cryptography, specifically the ML-KEM standard, to secure its operations. With global ransom payments dropping to 28% in 2025, groups like ShinyHunters are shifting to encryptionless extortion, focusing on data theft and public leaks. The industrialization of ransomware attacks is supported by initial access brokers exploiting RDP and VPN vulnerabilities. Qilin emerged as the most active ransomware group, alongside Cl0p and Akira. Law enforcement has responded with takedowns of major dark web platforms, including RAMP and LeakBase, to disrupt these operations. The overall landscape shows a shift towards more sophisticated and varied attack methodologies. 2 sources 61

Extracted Entities

Ransomware State: Encryptionless Extortion, Post-Quantum Cryptography, EDR Killers

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Companies (1)

Malware (1)

MITRE ATT&CK (7)

Ransomware Groups (8)