Securing against ransomware

Dive Brief:

Cybercriminals are becoming much faster at handing off initial access in targeted environments, with the window shrinking to just 22 seconds in 2025, according to a report by Google Threat Intelligence Group and its incident response unit, Mandiant. That compares to about eight hours in 2022.

Exploits remained the leading initial access vector, with 32% of all methods, according to the report. However, voice-based phishing has surged as an initial access vector, rising to the second-leading means of entry, at 11%. Voice-based phishing was the top method for all cloud intrusions, at 23%.

Meanwhile, the global median dwell time rose to 14 days, driven largely by cyber espionage campaigns as well as North Korean IT worker scams, which saw median dwell times of 122 days.

Dive Insight:

The GTIG and Mandiant report is based on analysis of more than 500,000 hours of incident response work Mandiant provided in 2025. 

The report found that threat groups are becoming much more deliberate and integrated in how they work with each other. Analysis showed significant coordination and planning for actions during the window between initial access and a secondary actor taking advantage of that access. 

During ransomware and extortion incidents, threat groups are increasingly specializing in specific tasks during the attack life cycle, according to Mandiant researchers. 

“Often these threat actors establish partnerships with other threat groups where the initial access partner acts as a distribution cluster,” Scott Runnels, consulting leader at Mandiant–Google Cloud, told Cybersecurity Dive. “In these relationships, the secondary threat group’s malware is automatically deployed on a compromised system when the first threat group gains initial access — this is the handoff.” 

The report also shows how ransomware groups make it tougher for security teams to recover from attacks. Groups like Akira and Qilin deliberately target backup infrastructure, identity services and virtualization management to frustrate security teams trying to restore critical data. 

Such tactics make it more difficult for organizations to avoid paying extortion demands.

Coca-Cola said production has mostly resumed at its Fairlife dairy facilities in the U.S. following a ransomware attack earlier this month. 

The company previously suspended operations at Fairlife after hackers gained access to certain systems and stole data. Fairlife is a maker of ultra-filtered, lactose-free milk, as well as protein and nutritional shakes. 

Limited timeline

A ransomware-as-a-service group called Anubis took credit for the attack. The hackers claimed to have locked Fairlife’s servers and stole up to 1TB of data, according to researchers at Arctic Wolf. Anubis threatened to leak information if its demands were not met, but details of the extortion demand were not disclosed. 

Anubis previously gained entry to targeted sites through the use of stolen credentials or by exploiting critical vulnerabilities, including CitrixBleed2, tracked as CVE-2025-5777, Arctic Wolf said. 

Anubis operates using three affiliate models, according to researchers at Sophos. The group engages in traditional ransomware-as-a-service as well as data-theft-only extortion and access monetization. 

Coca-Cola, while acknowledging the attack was linked to ransomware, did not comment on how it was able to restore production. The company also did not provide any details about how the hackers gained access to the Fairlife systems. 

Coca-Cola said retail access to Fairlife’s milk products largely were not an issue, due to the wide availability of existing inventory. The company said Fairlife’s Canadian business was not impacted at all.

The company does not believe the attack will have a material impact on its financial condition or results of operations. Fairlife is a large business for Coca-Cola, surpassing $1 billion in annual revenue starting in 2022. The dairy unit has four locations in the U.S.

Earlier this year, Coca-Cola announced a $650 million investment to expand the size of its Coopersville, Mich., facility. The company is also set to open a 745,000 square-foot facility in Webster, N.Y. 

The beverage giant said it is still working to fully restore all impacted systems and operations. 

Sponsored content

By Arctic Wolf

Ransomware still dominates incident response work, but the way attackers get in has quietly narrowed. The 2026 Arctic Wolf Threat Report, drawn from hundreds of real-world incident response engagements over the past year, found that 65% of non-BEC intrusions began with abuse of remote desktop protocol (RDP), virtual private network (VPN), and remote monitoring and management (RMM) tools. That is up sharply from two years earlier. 

Every top-exploited CVE in the report dated to 2024 or earlier. The tradecraft that ends in an encrypted environment is not exotic. It is remote access, valid credentials, and a patch someone did not apply. 

Two Investigations, One Playbook 

Arctic Wolf® Labs published two ransomware investigations this year that show what that looks like in practice. 

In June 2026, Labs investigated multiple distinct intrusions that ended in Qilin ransomware, all originating from exploitation of an authentication bypass in an internet-facing VPN gateway (CVE-2026-0257). Post-exploitation tradecraft varied from rapid encryption-only operations to full double extortion, which suggests several affiliates working under one ransomware-as-a-service brand. The operational patterns held steady even as the tradecraft varied. Payloads staged in C:\PerfLogs, PsExec for lateral execution over administrative shares, password-protected payloads, and log-clearing routines that wiped every Windows event log in a single action. 

A separate set of 2026 investigations traced Anubis ransomware intrusions to two entry points, valid VPN credentials and exploitation of CitrixBleed 2 (CVE-2025-5777). Once inside, the affiliates barely used custom malware. They installed legitimate remote management software instead, including ScreenConnect, Zoho Assist, MeshAgent, Remotely, Total Software Deployment, UltraVNC, and mRemoteNG, then built alternate outbound paths with Cloudflare tunnels, authenticated proxies, and SSH-based SOCKS tunneling. They went after domain controllers, hypervisors, backup-adjacent systems, and network-attached storage. 

The overlap between the two is worth noting. Both brands staged in C:\PerfLogs, named the Windows encryptor win.exe, deployed MeshAgent under a scheduled task called MeshUserTask, and disabled Microsoft Defender real-time protection before encrypting. Neither investigation found a link between the groups. They simply converged on what works. 

Speed is the other constant. In one Anubis intrusion, encryption began across the environment less than an hour after the attacker extracted the Active Directory database. Detection after that point is documentation, not defense. 

Encryption Is Becoming Optional 

The bigger shift is what attackers do with access once they have it. Data incidents jumped from 2% of Arctic Wolf incident response cases to 22% year over year, and data-only extortion incidents surged 11 times. Attackers increasingly skip encryption and go straight to the threat of publication. 

That breaks the assumption underneath a lot of ransomware programs. Tested backups answer an encryption event. They do nothing about a countdown clock on a leak site. 

How To Change the Outcome 

The defensive picture is more encouraging than the threat picture. Pre-ransomware activity accounted for 5% of cases, meaning teams detected and disrupted the attack before anything was encrypted. In 77% of ransomware cases, organizations did not pay at all. When they did pay, professional negotiation reduced demands by an average of 67%. 

The practical steps to changing the outcome of a modern ransomware event are unglamorous and they map directly to the two investigations above. 

• Patch internet-facing remote access appliances, then terminate every active session. A patch does not invalidate a hijacked session

• Rotate credentials after any exposure, including the KRBTGT account twice, per Microsoft guidance

• Treat several RMM tools appearing in a short window as an adversary indicator, not an IT quirk

• Alert on Windows Security Event ID 1102, log clearing. It is an uncommon administrative action and a reliable signal

• Restrict execution from staging directories such as C:\PerfLogs and C:\Users\Public

• Segment hypervisors, backup infrastructure, and network-attached storage from the general network

The Takeaway 

The ransomware playbook has become predictable, and that is the opening. Attackers are logging in with trusted access and reaching for tools defenders already have installed, which means the controls that matter are visibility across identity, endpoint, network, and cloud, plus the ability to act in the hour that decides the outcome. Aurora® Managed Detection and Response and Arctic Wolf Incident Response are built around exactly that window.

Dive Brief:

Many ransomware victims remain vulnerable to follow-up cyberattacks, even after they complete their incident response processes, highlighting gaps in mitigation activities that increase their odds of becoming repeat targets, the security firm Black Kite said in its annual ransomware report.

The report described how victims fail to patch critical vulnerabilities and properly configure email security tools, underscoring the importance of thorough digital cleanup operations as part of the ransomware recovery period.

Black Kite also shared fresh data on the ransomware ecosystem and its top targets.

Dive Insight:

Because ransomware is a profit-motivated business, cybercriminals prioritize the easiest and most lucrative targets, and if an organization fails to fix the problems that opened the door for hackers in the first place, they are likely to return. That fact makes it imperative for hacked businesses to fix digital liabilities as soon as possible after an incident, lest hackers revictimize them seeking another payout.

But many organizations haven’t learned that lesson and continue to operate with serious cybersecurity weaknesses.

Forty-three percent of victimized organizations still have at least one unpatched critical vulnerability, and 31% still have at least one vulnerability that the Cybersecurity and Infrastructure Security Agency says hackers are currently exploiting.

In addition, 59% of victims still haven’t properly configured their Domain-based Message Authentication, Reporting & Conformance (DMARC) email authentication systems, which can protect organizations from phishing attacks and business email compromise scams, and 32% still have misconfigured DomainKeys Identified Mail (DKIM) records, leaving their email domains open to impersonation.

“These signals show what remains visible after the incident closes: conditions that attackers can observe, rank, and reuse,” Black Kite researchers wrote in their report. “These signals matter because ransomware operators do not need a single perfect entry point. They need enough evidence that access may be available, identities may be weak, or trust controls may be incomplete.”

Even as those weaknesses remain unaddressed, hackers are getting better at crafting the kinds of attacks that ensnare businesses every day — and AI is helping them do it.

AI isn’t unlocking devastating new intrusion capabilities, researchers said. Instead, it’s helping unsophisticated hackers generate workable tools that level up their capabilities. “The clearest early signal [of AI value] came from lower- and mid-tier actors,” Black Kite said, noting that the amateur FunkSec threat group “showed signs of AI-assisted development, including tool and encryptor work that appeared more polished than the operator’s apparent technical maturity would suggest.”

And with spear-phishing and impersonation attacks remaining a prime avenue for intrusions, AI is helping ransomware gangs generate increasingly convincing-sounding messages that are helping them fool help-desk employees and other corporate workers. “This is especially important because some of the year’s most disruptive intrusions were not defined by malware sophistication alone,” Black Kite said. “They were defined by attackers understanding how people, vendors, support desks, and identity workflows actually operate.”

Black Kite’s report — which is based on dark-web monitoring of nearly 300 ransomware groups, open-source analysis of victim infrastructure and intelligence from the company’s endpoint detection platform between April 2025 and March 2026 — also confirmed other recent industry findings about the ransomware ecosystem.

While 61 new groups entered the ecosystem during the reporting period, the threat landscape remains heavily concentrated — “the five largest actors still controlled 43.6% of all victims,” Black Kite noted.

In addition, manufacturing remains the most victimized sector, with its 1,660 victims accounting for 22% of all intrusions announced on dark-web leak sites. Black Kite has seen the manufacturing sector top its list for the past four years, and in 2026, the sector remained in first place in every month of the reporting period.

Iran, long considered a steady and persistent cyber threat to the U.S., has raised its game in the months since the two nations went to war in February. 

Iranian-backed cyber threat groups, which range from state-sponsored actors to pro-Iranian hacktivists and financially motivated hackers, appear to have evolved some of their motivations and capabilities in cyber, according to analysts and security researchers. 

“What we are seeing are attacks that are aiming to have a more destructive effect,” Annie Fixler, director of the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies told Cybersecurity Dive. 

Specifically, Iran-linked actors have increased the use of data wiping malware in recent attacks against Israel and demonstrated greater capability to evade detection, according to researchers at Palo Alto Networks. 

In another alarming development, Darktrace last week published an analysis of a malware strain called ZionSiphon, to potentially tamper with chlorine levels and pressure controls in Israeli water facilities. The malware was embedded with pro-Iran and Palestinian messaging for additional psychological impact. 

Recent military strikes by Iran may have combined exploitation of flaws in video cameras and kinetic military strikes, according to Check Point Research. The activity may indicate a higher level of coordination and could be used potentially against critical infrastructure, surveillance and other targeted threat activity, CCTI’s Fixler noted.

Meanwhile, the bombing campaign by the U.S. and Israel exposed weaknesses in Iran’s traditional military capabilities, such as its limited ability to control and defend its own airspace and directly challenge allied bombing campaigns. But the Iranians have used cyberattacks as a way to send messages to neighboring Gulf states, Israel, the U.S., and to its own political dissidents, for intimidation, espionage and destructive acts.

Cyber threat warnings

In March, cyber-threat-sharing groups across various critical infrastructure sectors issued a joint advisory warning about the heightened threat of cyberattacks from Iran-aligned actors. 

“Since we released the report, we have indeed seen reports from the critical infrastructure community about Iranian-aligned activity,” Scott Algeier, executive director of the Information Technology-ISAC, told Cybersecurity Dive. 

The data-wiping cyberattack on medical device maker Stryker in March represented the most high-profile example of an Iran-linked attack, Algeier noted, but there have been reports of cyberattacks targeting critical sites as well. Iran-nexus actors are continuing to focus on programmable logic controllers used in OT environments, for instance, he said. 

Nick Andersen, acting director at CISA, said at a Thursday hearing before the House Appropriations Subcommittee on Homeland Security that Iran-linked actors have stepped up activity against poorly configured critical infrastructure sites in the U.S., but have thus far been unable to make significant inroads. 

CISA and other agencies have warned for several years about hacktivist groups exploiting weak security controls at critical infrastructure sites. 

Anderson noted the U.S. has a “tremendous amount” of IT and OT being used to support critical infrastructure that is exposed to the public internet, unsecured and “not necessarily taking advantage of modern security practices” like changing default passwords.

“When we look at them [Iran] as a specific nation-state threat actor, they’ve been very opportunistically focused where we see unsecured devices that are internet accessible,” Andersen testified during the hearing. “It provides them with an opportunity to attempt to make connections to those devices.”

CISA and the FBI, meanwhile, led a joint advisory about the Iran-nexus threat activity in April, warning that malicious hackers were targeting Rockwell Automation/Allen-Bradley devices at water utilities, energy facilities and other industrial sites. 

The advisory, which was co-authored by the U.S. Department of Energy, the Environmental Protection Agency and other federal partners, warned that attackers tried to manipulate human machine interfaces and supervisory control and data acquisition displays.

While authorities have not provided details breaking down the specific pattern of attacks, researchers have been able to trace some of the activity to specific threat groups.

Palo Alto Networks Unit 42 linked a cluster of threat activity in late March to the same Rockwell Automation devices cited in the FBI advisory, according to an updated blog post released Friday. 

A threat group tracked as CL-STA-1128 (also tracked as Cyber Av3ngers or Storm-0784) abused Rockwell Automation’s Factory Talk software by installing it onto virtual private server infrastructure, according to Unit 42 researchers. 

Asymmetric cyber capabilities

Iran in recent years has demonstrated the ability to leverage a network of state-sponsored and hacktivist operatives to sow fear, discord and operational disruption via cyber campaigns. 

U.S. authorities, including CISA, have tracked a group of advanced persistent threat actors since at least 2018 under the name MuddyWater, also known as Seedworm or Static Kitten. The group, operating under Iran’s Ministry of Intelligence and Security (MOIS), has targeted rival governments, defense industries, telecommunications and energy providers through spear phishing, exploitation of known vulnerabilities and abuse of open source tools for conducting cyber espionage, stealing sensitive data and deploying ransomware.  

In 2022, the U.S. Treasury sanctioned MOIS in connection with threat activity against the U.S. and other allies dating back to 2007. Treasury cited a July 2022 cyberattack against the Albanian government, where an Iran-linked group called HomeLand Justice gained access to a targeted computer network for 14 months before unleashing ransomware and disk-wiping malware. 

Iran also has long used cyber to target critical infrastructure against Israel, its leading geopolitical rival. During the Gaza War starting in 2023, these attackers also targeted water utilities and other critical infrastructure in the U.S. 

Drinking water and wastewater treatment facilities in the U.S. also have been victims of Iran-linked cyberattacks, specifically in a campaign that exploited weaknesses in Unitronics PLCs. The U.S. has about 150,000 public water facilities and 16,000 wastewater treatment sites, most of which lack the manpower, funding or training to thwart such attacks. 

The water sector has traditionally been a relatively easy target. A federal probe in 2024 found hundreds of U.S. water sites were either exposed to the internet or contained other configuration weaknesses. The report also found the Environmental Protection Agency lacked an incident reporting plan or documented procedures to coordinate with CISA. 

Security industry leaders say the current cyber threat to water and other utilities represents a clear escalation of capabilities by Iran-linked threat groups. 

Jennifer Lyn Walker, director of infrastructure cyber defense at the Water Information Sharing & Analysis Center, said the prior activity linked to CyberAv3ngers was more of a “nuisance threat” that lacked sophistication. But the current threat activity represents an “escalation to include intent to cause disruption with malicious actions,” Walker told Cybersecurity Dive. 

Despite the recent threat activity, the EPA said drinking water remains secure.“The ability of water systems to deliver safe drinking water to communities has not been impacted,” a spokesperson said.

The feds have taken some action against Iranian threat actors: following the attacks on water systems and other critical sectors, the Treasury Department in 2024 issued sanctions against members of the Islamic Revolutionary Guard Corp., citing malicious activity against various critical sectors in the U.S. Among those attacks was an 2021 ransomware attack targeting Boston Children’s Hospital that was disrupted by the FBI.

Hackers gain persistence

The cyberattack against Stryker demonstrated a capability that exceeds what was previously known about Iran-linked actors: the deployment of a destructive wiper that abused the company’s Microsoft Intune environment and deleted data from thousands of mobile devices. 

CCTI’s Fixler and other analysts say the attackers likely obtained credentials and established a foothold in Stryker long before the attack. However, the attack remains under investigation, so an official breakdown has not yet been released. 

Handala, the cyber threat group linked to the Stryker attack, now claims to have gained persistent access to Microsoft Entra, VMware vSphere and IBM FlashSystem environments across multiple targeted organizations, according to researchers at Flashpoint. 

“The screenshots that they shared in their channel indicate that these are part of several attack campaigns, though it is difficult to verify until we have confirmation from the victims,” Ian Gray, VP of intelligence at Flashpoint, told Cybersecurity Dive. 

Those screenshots show the attackers’ ability to generate Temporary Access Passes within Microsoft Entra, which allows the hackers to bypass multifactor authentication, according to Flashpoint. 

Microsoft officials declined to comment. IBM and Broadcom officials were not immediately available for comment.

In March, CISA urged security teams across the country to harden their endpoint security following the Stryker attack.

Defending against Iran cyber threats

There are several steps that security teams should take to mitigate against potential attacks from Iran-nexus threat actors. For one, internet-facing devices should be removed from open access, and multifactor authentication should be enabled, according researchers. 

Security teams should also create strong backup copies of PLCs, which include the logic and configurations for industrial equipment and systems.

If controllers include a physical mode switch, it should be placed in the run position to prevent remote modification, according to the CISA and FBI advisory. 

To protect against wiper attacks, security teams should eliminate standing privileges and also harden Entra ID administrator accounts, according to Palo Alto Networks researchers. 

Dive Brief:

• Medium-sized businesses accounted for roughly three-quarters (73%) of ransomware incidents between 2023 and the first half of 2026, according to the risk management firm Black Kite.
• Manufacturing was the most targeted industry (accounting for more than 25% of those victims), and nearly 30% of mid-market organizations had at least one known exploited vulnerability, the firm said in a report.
• The findings add to the challenges facing mid-market firms, which include large customers demanding accountability and a vast array of suppliers that the mid-market firms lack the personnel to hold accountable.

Dive Insight:

Mid-market firms, defined as those with annual revenue between $10 million and $1 billion, receive comparatively less attention in cybersecurity discussions than either small businesses, whose struggles and weaknesses are well understood, or large companies, whose industry importance leads to widespread media coverage when they suffer hacks. Black Kite’s report, based on an analysis of 13,336 ransomware incidents between January 2023 and June 2026, examines the unique position that mid-market firms find themselves in, a dynamic that affects their ability to protect their systems.

Companies’ twin roles as suppliers and customers “are usually treated as separate problems, handled by separate teams under separate budgets,” the report said. “In a mid-market company they are rarely handled by anyone at all, and they are the same problem seen from two directions.”

The most victimized sectors — manufacturing, professional services, construction and wholesale — are full of companies that supply other companies, meaning that the damage from a cyberattack can quickly cascade downward and outward. “When one of these companies is attacked,” Black Kite said, “the incident is recorded against its own name, but the damage does not stop there.”

These supply-chain risks explain why large companies with medium-sized suppliers ask those mid-market firms to answer so many security questions, according to the report, which listed examples of regulations in the U.S. and Europe that codify suppliers’ cybersecurity responsibilities.

But mid-market firms often struggle to meet these oversight demands.

“Industry surveys of vendor-risk programs find teams of two or fewer people responsible for portfolios that run well past three hundred suppliers,” Black Kite researchers wrote, “a ratio that makes continuous oversight impossible by hand.”

Ransomware attacks during Black Kite’s research period were not evenly distributed across the mid-market. The smallest slice of those companies — those with annual revenue between $10 million and $50 million — accounted for roughly half of all incidents, followed closely by the “core mid-market” ($50 million to $500 million), with 40% to 45% of incidents. Very few “upper mid-market” firms ($500 million to $1 billion) experienced ransomware incidents; Black Kite noted that the number fell from 126 in 2023 to 45 in 2025, a 64% decline.

Black Kite’s report is based on data collected from the networks of 120,128 mid-market businesses in North America and Europe, but the company found that North America heavily dominated the data set. Seventy-two percent of mid-market attacks during the research period targeted North American companies, and the number of North American victims grew from 2023 to 2026, even as the number of European victims effectively remained flat.

WASHINGTON — The FBI said it intends to formalize and speed up its collaborative takedowns of malicious hacking activity.

The bureau’s new four-part strategy describes how it will investigate, attribute and disrupt cyberattacks; quickly engage with victims and share useful information; partner with other agencies and the private sector; and enhance its own capabilities through recruitment, training and new tools.

“Our strategy is really focused on moving beyond the ad-hoc way that we do [disruptions] right now … to do it in a more steady state,” Brett Leatherman, the assistant director of the FBI’s Cyber Division, said during a talk here at the Billington Cybersecurity Summit.

The FBI has already significantly increased the number of disruption operations it has led and participated in over the past few years. Recent high-profile takedowns have targeted a Russian military intelligence agency’s router botnet, domains that the Chinese government used to target U.S. critical infrastructure and the AlphV ransomware gang. But the bureau’s new strategy reflects government officials’ fear that even this increased tempo has not been enough.

The cyber threat environment “is becoming untenable for any one organization to defend alone, and we have to bring consistency in how we approach it,” Leatherman said. “Every day, we’re having to send teams out across the [FBI’s] 56 field offices to help victims who are continually under attack.”

As part of the new strategy, FBI teams focused on countering specific threats, from Russia to China to cybercriminals, will develop their own customized plans. Teams focused on specific kinds of operations, including offensive hacking and investigating operational technology breaches, will also develop tailored strategies.

Reassuring reluctant companies

One of the cyber strategy’s goals is to convince companies that they should report hacks to the FBI because it cares about helping them and won’t share their reports with regulators.

“We have [seen] a lot of hesitation recently from organizations to quickly provide information that would support law enforcement operations,” Leatherman told reporters after his talk.

The FBI has seen a reduction in companies’ willingness to share information over the past few years, a continuation of a long-running trend. “I don’t know exactly why that is,” Leatherman said. He attributed it partly to “uncertainty about the FBI’s value in cyber” and partly to “concern about the regulatory environment and what the FBI may or may not share with regulators.”

The bureau is trying hard to address companies’ concerns, including through summits with law firms that specialize in advising companies on incident response.

“It worries me,” Leatherman said of companies’ reluctance to engage with the FBI. “It worries me when an organization is breached by a nation-state actor and believes that bringing law enforcement in might be more risky than handling it on their own. That should worry all of us.”

No company, he argued, is better positioned to evict Chinese government hackers from their networks on their own than they would be with the FBI’s help.

“We see things through our cyber authorities that no incident response company sees,” Leatherman said during his Billington talk. “If you reach out to us early, we can bring threat intelligence tools and capabilities to bear that you can't get elsewhere.”

Leatherman urged executives to meet with their lawyers now to increase their comfort with engaging the FBI. “Too often, I see weeks move by where outside counsel is the gatekeeper of information going to the FBI,” he said. “Discussions happen on breached networks, and as a result of that, actors [have a] leg up and they can move in and entrench themselves even harder.”

Collaboration also benefits the broader ecosystem, he noted. “Victims reporting early and providing information early allows us to move upstream against actors that are quickly moving across infrastructure in the U.S., Europe and beyond.”

In the past, the FBI has been reluctant to share significant information with organizations that could help them protect themselves, for fear of jeopardizing its sensitive investigations. That has changed in recent years, Leatherman told reporters.

“We have changed significantly our perspective on sharing quickly and more often than maybe what we did in years past, where we would preserve it for operational opportunities,” he said.

That has required what Leatherman called “a culture shift” inside the FBI’s Cyber Division, where agents are used to zealously guarding the technical details of their work for fear of tipping off adversaries.

Now, “our posture is: share until it hurts,” Leatherman said. “What I always ask my team is, if the victim were sitting in this room right now, or the potential victim, would they want this information, and what is the compelling justification we have to not share this now to stop the impact versus taking an operation?”

“In every situation where we have intelligence, we have to take that victim perspective because they can’t voice it in that moment,” he added. If the bureau “can have an impact to hundreds of pieces of critical infrastructure, we should share that.”

Expanding hacking partnerships

A major theme of the FBI’s cyber strategy is the bureau’s desire to partner with more organizations on disruption operations. But its investigations may run into new problems as the Trump administration implements an initiative to let private companies hack foreign cybercrime gangs on behalf of the U.S. government. Experts have warned that uncoordinated cyberattacks could interfere with the FBI’s monitoring of foreign targets.

Leatherman told reporters that it was too early to predict the effects of the new White House initiative, noting that the Justice Department is still “working on understanding the lanes in the road as to how those authorities apply to industry versus law enforcement.” But he emphasized that DOJ and the Department of Homeland Security will approve and closely supervise private hacking activities.

“This is not a situation where industry is going to pick targets and go after targets themselves,” he said.

Meanwhile, the FBI’s new strategy envisions the bureau’s own disruptive operations increasing in frequency and scope.

“As opposed to waiting for large joint sequenced operations that happen half a dozen times a year,” Leatherman said, “you're going to start to see many more of those [operations] of consequence, because we are engaged in that urgent, steady-state opportunity to disrupt adversaries.”

The bureau’s goal is to “make industry an operational partner in this fight,” he said, “as opposed to just somebody we share threat intelligence back and back and forth with.”

Dive Brief:

The number of ransomware attacks that hackers claimed on dark-web leak sites rose by nearly one-fifth in 2025, to 6,883, while the total number of leak sites increased by roughly one-third, to 115, the security firm Bitsight said in its annual “State of the Underground” report.

Ten groups — five of them associated with Russia — were responsible for roughly 58% of attacks, according to the report, suggesting a remarkable concentration of activity.

Roughly 60% of ransomware victims were in the U.S., with the manufacturing sector topping the list.

Dive Insight:

While ransomware attacks surged, traditional data breaches fell by 41% in 2025 compared with the previous year. Bitsight cautioned, however, that the decline was likely the result of reporting gaps and evolving threat-actor behavior rather than a reduction in risk.

“Attacker focus shifted toward domino-effect targets, including critical infrastructure and defense, government, and utilities,” researchers wrote.

Educational institutions experienced the most data breaches in 2025, with 505, followed by government (475) and IT (469). That represented a significant shift from 2024, when IT topped the list, with 1,210 breaches.

The data-breach landscape in 2025 was “less dominated by a single sector and more distributed across industries with personally identifiable information (PII) and operational and supply chain importance,” Bitsight said in its report.

As AI tools have become a more useful tool for defenders, they have also become increasingly valuable to hackers. On the cybercrime forums and Telegram channels that Bitsight monitors, the company tracked 5.1 million mentions of Google’s Gemini platform, 1.4 million mentions of OpenAI’s ChatGPT service, 656,000 mentions of Anthropic’s Claude tool and 697,000 mentions of xAI’s Grok chatbot.

Misconfigured and poorly secured AI platforms also represent weak spots in businesses’ networks. The number of publicly exposed AI tools increased by 360% in 2025, to more than one million, led by instances of n8n and Open WebUI, both of which have had serious vulnerabilities.

Hackers’ increased use of AI tools and businesses’ increased use of vulnerable AI services mean that security teams can’t rely on old strategies, Bitsight said.

“As the window between vulnerability, discovery, and exploitation shrinks, prioritization will play a larger role as both defenders and threat actors learn how to leverage AI for their needs,” researchers wrote. “We are no longer in an era where critical vulnerabilities can be patched on a schedule.”

Dive Brief:

Ransomware activity grew slightly between the first and second quarters of 2026 but significantly year over year, and there were more hacker groups active during April, May and June than in any previous quarter, researchers said.

Cybercrime actors claimed breaches of 2,279 victims in Q2 2026, a 7% increase over Q1 2026 but a 43% year-over-year increase compared with Q2 2025, GuidePoint Security said in a quarterly report.

The Qilin ransomware gang led the quarter, accounting for 13% of attacks, but the relatively new group The Gentlemen has grown quickly and now accounts for almost as much activity, GuidePoint said.

Dive Insight:

While the ransomware ecosystem continues to grow, both in terms of attacks and actors, the activity is not widely dispersed. “The five most prolific groups in Q2 2026 collectively claimed more than 40% of all recorded attacks,” GuidePoint analysts wrote. “We continue to see records broken in the volume of distinct named ransomware groups, but the most prolific at the top continue to consume a highly disproportionate share of victims.”

Qilin, The Gentlemen, Akira and DragonForce compromise what GuidePoint calls the “four-headed monster” of high-volume ransomware groups. The lack of a “singular monolithic figure” could make the ransomware community more resilient to law-enforcement takedowns, the security firm said, because there are now “multiple franchises poised to absorb displaced affiliates if another were to disappear overnight.”

The U.S. accounted for the plurality of ransomware victims in Q2, with 40%, but Germany wasn’t far behind, with 32%. GuidePoint said it was notable that the U.S. share of incidents had dropped from previous quarters, when roughly half of victims were American organizations. “This increased focus on the other countries coincides with an activity increase by The Gentlemen, Qilin, and LockBit,” analysts wrote. “Each of these claimed the most victims outside of the U.S’s borders during Q2 2026.”

These groups are increasingly using AI in their attacks, but GuidePoint found that they’re not doing so in exotic or even sophisticated ways.

“The prevailing concern that AI will enable a new class of catastrophic AI-native attacks remains largely unrealized,” GuidePoint researchers said. Instead, threat actors are using AI as a productivity tool that “lowers the cost of repeatable tasks that were already being done by human operators.”

In two case studies discussed in the report, AI helped cybercrime gangs do things they might have been able to do on their own, but with significantly less effort.

In one attack, the data-extortion group FulcrumSec used a large language model (LLM) to analyze a massive trove of stolen data and identify users present in multiple databases. “Due to the complexity of the database schema, this analysis of a victim’s data would have been implausible without either deep internal knowledge of the victim’s databases architecture, a substantial period of focused human attention, or AI assistance,” GuidePoint said.

The analysis — combined with AI-generated English-language negotiation messages — “helped the group anchor their position and drive negotiations from their side,” GuidePoint researchers wrote, “in effect saying: ‘We know what we have taken, here it is, and this is why we have set the ransom at this amount.’” In doing so, the researchers added, “FulcrumSec established a firm negotiating stance from which they had little incentive to diverge.”

In another attack, the DragonForce group used LLMs to compose convincing claims that increased the pressure on their victim. “The group has claimed to have legal counsel on staff,” GuidePoint said — a claim that, while “almost certainly false,” is meant to frighten victims into thinking the hackers understand victims’ legal and reputational risks.

“For criminal purposes, it doesn’t matter if the claim is true; it only matters if it sounds plausible,” GuidePoint researchers wrote. “If there’s one thing LLMs are good at, it’s making a wide range of statements sound plausible.”

Dozens of North American companies have been targeted in a social engineering campaign that abuses Microsoft Teams to deploy ransomware, according to a report by cybersecurity firm Sophos.

A threat group, tracked as STAC4749, has initiated chats or calls through Microsoft Teams under the guise of providing help desk or IT support to companies in the U.S. and Canada. 

After initiating a remote session through Microsoft Quick Assist or the cloud-based RemSupp tool, hackers deploy PowerShell in order to establish persistence and execute malicious payloads. 

The attacks come months after a Rapid7 report of Iran-linked MuddyWater conducting a false-flag campaign where they presented themselves as financially motivated actors. Sophos researchers explored possible links, but they believe the STAC4749 attacks are actually linked to a criminal actor.

“Based on the evidence we observed, this activity is most consistent with a financially motivated cybercriminal operation rather than state-sponsored actors,” said Morgan Demboski, threat intelligence analyst at Sophos. “Data was stolen in a subset of intrusions, but we did not observe behavior typically associated with espionage-focused actors, like long-term persistence, efforts at covert access, or targeted intelligence collection.”

The attacks were consistent with double-extortion operations that prioritize speed, according to Demboski. 

In at least three cases, the hackers deployed Chaos ransomware on a compromised system. Researchers said in one of the cases, the time between initial access to deployment of ransomware was 17 hours, which is consistent with prior Chaos cases. 

The observed attacks ran between February and June, targeting organizations in the services, manufacturing, energy, construction and engineering sectors.

Chaos ransomware-as-a-service has been active since February 2025 and has been linked to former members of BlackSuit ransomware, according to Sophos. Several of the tactics used in the recent campaign align with prior attacks connected to Chaos, including the use of Microsoft Teams along with Quick Assist for vishing. Prior attacks have also employed DWAgent and AnyDesk for lateral movement, according to Sophos.

Enterprises holding cyber insurance policies are undergoing more scrutiny in their claims as rates decline and insurers scramble to remain profitable.

The stakes are high for both sides. Insurance companies around the globe increasingly fear their business is overly dependent on large U.S. policyholders, which make up nearly two-thirds of their global market share. They worry that one large supply chain event or outage could escalate and ultimately wipe out the cyber insurance industry as a whole. 

These market pressures have led to a shift in the cyber insurance business model, where cyber insurers are developing sophisticated risk models to prepare for large-scale attacks that could disrupt a wave of policyholders at the same time.

Meanwhile, insurers are also pressuring policyholders to make sure they button up governance and security controls and have mitigations in place for any risk incurred by their third-party technology partners. 

“Insurers today generally have a better understanding of cyber risk quantification and are placing greater emphasis on security controls, technology dependencies and exposure to systemic cyber events,” said Anjali Nagrani, principal cyber cat risk product adviser at CyberCube, a firm specializing in cyber risk modeling. “Organizations with weak cyber hygiene may face more scrutiny and coverage restrictions, whereas well-prepared companies can access broader coverage and improved terms.”

Ransomware and other cyber intrusions can add up to millions of dollars in recovery costs or more if the attack forces a company to halt order-taking, manufacturing or shipping. 

A 2025 report co-authored by Marsh McLennan and cybersecurity firm Dragos found that OT cyber incidents could lead to $329 billion in direct financial losses. The report, which was based on a review of 10 years’ worth of insurance claims, showed an average annual global risk of $12.7 billion, which includes the impact of business interruption. 

And a March report from Aon showed the average cost per global ransomware claim nearly doubled, to $713,000, in 2025, up from around $374,000 in 2024.  

The missing “middle”

The majority of the global market for cyber insurance is currently dominated by large corporations that have sophisticated risk management and mature cyber programs.

But there’s “a huge protection gap” in cyber insurance coverage, said Martin Kreuzer, senior risk manager for cyber risks at Munich Re, who added that across all industries, smaller organizations mostly go uninsured.

The data says it all: Coverage among small to medium-sized businesses is relatively weak, with some estimates showing only about 20% of SMEs are cyber-insured.

Small businesses typically don’t obtain coverage, because they don’t consider themselves a valuable target for cyber threat actors. They also often lack the resources to properly identify their cyber risk. Michelle Faylo, U.S. cyber at technology leader at Lockton, said this is due to a lack of understanding of the financial risks. 

“When we look at the volume of buyers that are missing in the middle market and the small business space,” Faylo said, “it’s because they don’t understand it.”

Tighter underwriting, higher scrutiny

Given the financial squeeze on cyber insurers over the past year, they have been more closely scrutinizing claims and pressuring customers’ security teams to prove they are properly maintaining their security controls.

The result: Policyholders are recovering a smaller percentage of the total cost of a breach, according to Gavin Mead, cyber, data and tech risk partner at PwC. Disputes between the insurance provider and policyholder often center around whether security practices — particularly multifactor authentication — were actually enforced during the breach. 

A significant amount of data breach costs are incurred by the victim organization’s response to a cyberattack, including forensic investigation, breach notification, credit-monitoring services and breach counsel. However, the larger exposure to a company is often the legal fallout, including class action data-breach suits from customers. 

“That tail can rival the incident itself in financial terms,” Mead told Cybersecurity Dive. In some cases, companies work to make sure they properly identify every customer that is exposed to a breach, thus extending the time and expense required to complete the incident response process, he noted. In certain cases, companies have either overnotified customers or failed to reach customers or other parties that may have been impacted, Mead noted.

Part of the frustration for buyers is a disconnect in how they are rewarded for strong security controls, according to Adam Abresch, executive vice president, cyber solutions at Acrisure. 

Insurance buyers can get coverage if they have managed detection and response or endpoint detection and response, but they don’t always benefit in terms of pricing, deductibles or breadth of coverage.

“There is still a disconnect between security posture and underwriting recognition, which remains a point of frustration for buyers,” Abresch told Cybersecurity Dive. 

Business resilience in focus

The cyber insurance recovery process in several recent cyberattacks — such as that of toymaker Hasbro — will be a bellwether for what insured organizations can expect from their providers in this compressed and mature cyber insurance environment, experts said.

Hasbro, one of the largest toy and entertainment companies in the U.S., experienced temporary delays in ordering and shipping in the wake of a cyberattack in late March. During an earnings call last month, the company said it would incur $20 million in operating expenses related to remediation from the attack.

The company also expects between $40 million and $60 million in consumer product revenue to be delayed from the second quarter through the second half of the year. “We’re going to see, given the cyber event, a little bit of lumpiness in cash as we move through the year,” Gina Goetter, the CFO and COO as Hasbro, said during the earnings call. 

It remains unclear what costs Hasbro will recover via its cyber insurance policy. The company plans to seek reimbursement for “certain costs, expenses and losses” related to the incident from its cyber insurance providers, according to a filing with the Securities and Exchange Commission. However, the company said it’s still documenting claims and has no immediate details of the claims or the “receipt, timing or amount” of any reimbursement. 

Geopolitical instability

Cyber insurance companies have been closely monitoring geopolitical tensions across the globe as well. The ongoing war between Russia and Ukraine and the U.S. war with Iran have become major flashpoints in the insurance sector. Threat activity linked to Iran-nexus actors has increased in recent months, including malicious attacks against key critical infrastructure providers in the U.S. What is not immediately clear is just how these attacks will be treated in the cyber insurance claims process. 

The geopolitical cyber pressures will lead to more reimbursement claims by large companies to cyber insurers. War exclusion language traditionally has placed major limits on cyberattack insurance coverage, particularly when state-linked threat actors are involved. But a shift began in a 2023 New Jersey appellate court ruling that upheld insurance claims by pharmaceutical giant Merck, which sought $1.4 billion in claims related to the 2017 NotPetya nation-state sponsored cyberattack. 

The Merck case was closely watched in part due to malicious cyberattacks related to the ongoing war in Ukraine. Then Lloyd’s issued guidance in 2024, noted Sridhar Manyem, senior director, industry research and analytics at AM Best, that said if insurer policies cover state-backed cyber incidents, the coverage must be granted in a “controlled and measurable way.”

That could have wide-ranging coverage implications for a wide range of industries, including energy companies, water utilities and other sectors that have been targeted by Iran-linked cyberattacks in recent months. Legal experts say victim organizations’ security teams will need to closely review the specific language in their respective cyber insurance policies to determine what is specifically coveredd and they also must ensure they had the proper controls in place at the time of their attacks.

“The proliferation of global conflicts and the comparatively relative ease with which ‘war’ can now be conducted, including by unmanned drones, cyberattacks or otherwise, may cause a continued rise in efforts by insurers to exclude such losses,” Jason Rosenthal, an attorney at Much Law, told Cybersecurity Dive. This will lead to “a rise in premiums for insureds who try to purchase specific insurance for such events,” he added.

Cyber incident response

Insurance providers have increasingly become more proactive in prescribing how insured companies must manage the incident response process. 

“Insurers are increasingly positioning themselves as active risk partners rather than just financial backstops that truly do want to provide a great claims experience and support the customer through what everyone agrees is a complex and stressful experience,” said Kevin Kiser, senior director of insurance alliances and solutions at cybersecurity firm Arctic Wolf.

Most insurance carriers route their policyholders through a “defined incident response ecosystem,” according to Kiser. The process may include a set of preapproved advisers, including a breach coach, who usually functions as legal counsel to the victim organization. Cyber insurers also often require preapproved security vendors to work with victims in the response phase, Kiser said.

AI growth without cyber guardrails

The explosion of AI adoption and weaponization also has raised alarm bells across the insurance sector. Threat actors are using AI to develop zero-day exploits, for example, as cited in a May report from Google Threat Intelligence Group. 

Businesses, meanwhile, are rolling out agentic AI and other programs that incorporate AI into their systems in the hopes that the technology will boost productivity and efficiency. But many AI implementations lack proper governance and security guardrails. 

“Real-world cases show AI improving phishing, fraud and large-scale exploitation while compressing attack timelines so that recovery capability, not detection, becomes the main driver of loss-severity,” said William Altman, director of cyber threat intelligence services at CyberCube. 

Rachel Turk, chief of market performance at Lloyds, echoed the AI concerns of cyber insurers during the company’s second quarter market presentation last month. She warned that AI would raise the specter of unmanaged risk to Lloyds’ clients and that no baseline scenarios currently exist to properly assess that risk. 

“The risk vectors for cyber continue to evolve, and AI adds another dimension and future uncertainty,” Turk said, “both by being used by threat actors and raising the question of potential coverage.”

Bracing for cyber insurance impact

The bottom line concern for CISOs and other leaders in this new cyber insurance risk climate is to factor in the ability to withstand a cyberattack, protect the integrity of your systems and minimize downtime.

Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center, said, “Organizations are really looking at what do we need to do to make sure that we can keep our major systems running if major IT systems start going down for whatever reason —whether it’s a bad guy or a bad update.”