Ransomware Gang Shifts Tactics: Data Extortion Without Encryption

For years, the ransomware playbook was predictable: break in, steal what you can, then encrypt everything on the way out to force a decision under pressure. One of the more prolific extortion crews tracked by threat intelligence firms has now dropped the second half of that equation entirely, according to a joint report from two incident-response vendors published this week.

The group's newer intrusions show no file encryption at all. Instead, victims receive a ransom note citing specific stolen files, sample documents as proof, and a countdown before public release. Analysts believe the change is pragmatic rather than ideological: encryption is noisy, easily flagged by endpoint detection, and increasingly recoverable through backups, while data theft alone triggers none of the alarms built to catch mass file modification.

That distinction matters enormously for defenders. Detection tooling built around anomalous encryption activity, file entropy spikes, and mass renames is largely blind to this approach, since the attacker's actual objective — quiet exfiltration — looks, at the network level, uncomfortably similar to normal backup or sync traffic if done patiently enough.

Responders interviewed for this piece say the shift is forcing a rethink of what a ransomware playbook even means for tabletop exercises. Recovery time objectives built around restoring from backup are irrelevant when nothing was ever encrypted; the crisis instead centers entirely on legal exposure, disclosure obligations, and negotiating with an adversary who holds a copy of your data rather than the only copy.

Several of the group's recent victims have been mid-sized healthcare and legal services firms, sectors where confidentiality obligations make the threat of publication especially costly regardless of whether operations are disrupted. Insurers are reportedly beginning to adjust ransomware coverage language to explicitly address extortion-only incidents, which some existing policies did not clearly anticipate.