Ransomware Tactics Evolve: Data Theft Surpasses Encryption

• •Ransomware groups are increasingly focusing on data theft rather than encryption.
• •The PAYLOAD campaign utilized Active Directory control without traditional ransomware methods.
• •Settra ransomware exfiltrates data before locking files, complicating recovery.

In 2026, ransomware groups are increasingly shifting from traditional encryption methods to data theft and extortion tactics. Kaspersky's Global Emergency Response Team reported on the PAYLOAD extortion campaign, where attackers seized control of Active Directory environments without encrypting data. Instead, they deployed ransom notes and manipulated system settings to demonstrate their presence and threaten data leaks. This trend reflects a broader shift in the ransomware landscape, as attackers find it more effective to threaten the publication of sensitive data rather than encrypting it. The Settra ransomware, identified by Cynet Research Labs, exemplifies this evolution by first exfiltrating data before locking files, complicating recovery efforts. The Settra group has claimed to have targeted between 50 to 70 organizations since its emergence in June 2026. This shift poses significant risks, especially for organizations with sensitive data, as data breaches can lead to reputational damage and regulatory fines. The trend indicates a growing sophistication in ransomware tactics, making detection and prevention more challenging.