DeafNews
// 3 CVE · 3 EXPLOIT IN THE LAST 24H→
Ransomware

Ransomware: Data Exfiltration Surges 275%, Terabytes Become the New Extortion Lever

Published: Updated: By Samuel Segato 6 min read Ransomware
Share
WhatsApp Facebook X (Twitter) LinkedIn Reddit Telegram Email
The 2026 ThreatLabz report documents an explosion in data theft: 896.2 TB exfiltrated, a 275.8% increase. The terabyte replaces encryption as the primary pressure tactic, while victim counts remain flat. Attackers target executives, abuse legitimate enterprise tools, and deploy malware that blends into cloud-native traffic.

The top ten ransomware groups exfiltrated 896.2 terabytes of data between April 2025 and March 2026, a 275.8% jump over the prior year. According to Zscaler's ThreatLabz 2026 Ransomware Report, released September 30, the number of victims posted on leak sites held essentially steady at 7,366 organizations, a 3% year-over-year decline. The leverage has shifted from locking systems to the sheer volume of stolen information.

Key Takeaways
  • Data exfiltration grew 275.8% to 896.2 TB while posted victims fell 3%: ransomware now bets on quantity, not attack visibility.
  • WorldLeaks dropped encryption for pure data theft, reaching 207.5 TB: the "pure extortion" model establishes itself as a structural alternative.
  • 62% of victims in a 351-case sample held managerial or senior roles; 75% worked in finance, sales, operations, HR, and marketing.
  • Attackers abuse legitimate enterprise tools—Microsoft Teams, Quick Assist, Google Drive API, and headless browsers—to camouflage malicious traffic.

The Technical Disintermediation: When Data Outvalues Encrypted Systems

The 275.8% exfiltration surge sits on an already ascending curve: from 123.8 TB in 2023–2024 to 238.5 TB in 2024–2025, to the current 896.2 TB. The acceleration more than tripled in the last year, signaling a regime break rather than trend continuity.

The most significant data point is the decoupling between stolen data volume and victim count. With 7,366 organizations posted, down 3%, groups extract more value from fewer targets. The average payment rose 5.3% to $431,995, while total payments fell 15.8% to $327.8 million and transaction count dropped 20.1%. Those who pay, pay far more: organizations with sensitive data assets face selective, intensified pressure.

WorldLeaks embodies this transition. With 207.5 TB exfiltrated, the group surpassed Rhysida (112.6 TB), Qilin (110.1 TB), and INC Ransom (96.6 TB). Its distinction is abandoning system encryption to focus exclusively on data theft and publication threats. The "pure extortion" model eliminates the technical overhead of cryptolocker ransomware deployment and reduces attack visibility, bypassing traditional compromise indicators based on mass encryption events.

"Successful ransomware extortion campaigns are abandoning traditional file encryption, which often causes operational disruption, in favor of less visible but potentially more damaging data theft attacks" — Deepen Desai, Executive Vice President of Cybersecurity at Zscaler

Executive Targeting and the Impossibility of Distinguishing Malicious Traffic

The report highlights a precise orientation in selecting internal victims. In a 351-case sample from a specific group, 62% held managerial or senior positions. Roughly 75% of victims operated in finance, sales, operations, HR, and marketing: functions with access to commercially sensitive data but typically lacking the technical training and structural defenses of IT departments.

Initial access leans on techniques that exploit daily familiarity with collaboration tools. Spam bombing, vishing via Microsoft Teams, and abuse of Quick Assist, AnyDesk, and TeamViewer let attackers operate inside legitimate enterprise traffic flows. The line between malicious and operational activity dissolves: remote support tools become persistence vectors not because they are vulnerable, but because they are trusted.

Embargo showed a 718% increase in median leak size in the second half of the observation period, confirming the volume trend is widespread across active groups. Manufacturing and technology remain the most targeted sectors, with extreme growth in freight & logistics (+725%) and utilities (+622%). Italy accounts for 2.7% of observed activity, versus 50.7% for the United States, 4.8% for Canada, 4.3% for Germany, and 4.1% for the United Kingdom.

Specialized Malware and Camouflaged C2 Infrastructure

The report details three campaigns illustrating technical sophistication geared toward blending into the target environment.

The Chaos campaign introduces GoGRPC, a Go-based malware family that uses gRPC over HTTP/2 for command-and-control communication. The protocol choice is deliberate: gRPC over HTTP/2 is standard in cloud-native and containerized environments, making C2 traffic indistinguishable from legitimate application traffic.

Another campaign employs a Java backdoor with a bundled JRE that leverages Google Drive APIs as a C2 channel. Using an enterprise cloud service for remote control turns exfiltration into apparently routine synchronization operations, challenging detection systems based on traffic analysis to suspicious domains.

The Payouts King campaign combines fake antispam updates, the Havoc framework, and a backdoor dubbed Edgecution. The latter comprises a malicious Edge extension in headless mode and a Python component, exploiting the browser as an execution platform to evade traditional endpoint defenses.

Nine of the top 15 groups by victim count are new to the leaderboard; 52 new groups activated in the last year. Qilin, Akira, and INC Ransom alone account for 34% of posted victims, but landscape fragmentation is increasing.

Action Plan

Operational recommendations derive directly from the report's evidence and Deepen Desai's statement.

Reduce initial access opportunities. The report documents attackers concentrating on reproducible early stages: spam bombing, Teams vishing, remote support tool abuse. Shrinking the attack surface at this level breaks the chain before compromise.

Contain lateral movement. Targeting executives in non-technical departments (finance, HR, marketing) with access to sensitive data demands segmentation controls that do not assume internal user trustworthiness based on operational role.

Block data exfiltration. The primary lever is now stolen data volume, not encryption. Exfiltration controls must measure in terabytes, not file-system events: detecting anomalous transfers to cloud services and storage tools takes priority over encryption monitoring.

Recalibrate defensive posture for silent theft. Encryption is visible and triggers immediate alerts; massive data exfiltration can proceed for weeks. Defenses must assume an ongoing attack will not manifest traditional indicators and employ behavioral analysis on enterprise data flows.

The Terabyte as the New Risk Metric

The ThreatLabz 2026 report ratifies a paradigm shift: ransomware risk assessment can no longer rest on victim count or attack frequency. When 896.2 TB can be extracted with a 3% drop in organizations hit, damage density per incident becomes the relevant parameter.

Generative AI enters this picture as an operational accelerator, not an autonomous attack technology. Desai places it in the "speed up operations" stream and focus on intellectual property theft, customer information, and sensitive data. The change is in tempo and precision, not threat nature.

The open question is countermeasure effectiveness in this new context. If malicious traffic is indistinguishable from legitimate traffic because it rides the same protocols and services, traditional signature- and network-anomaly-based detection loses ground. The report does not document which defensive architectures have successfully contained these techniques: a gap the security market must address with its own data, not product narratives.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references
  1. 01net.it
  2. ilcorrieredellasicurezza.it
  3. ir.zscaler.com
  4. zscaler.com
  5. globenewswire.com