Zscaler's 2026 Ransomware Report Finds Reported Data Leak Volume Up 275.8%
Report discovered via Awesome Annual Security Reports.
Summary
Zscaler ThreatLabz reports 896.2 TB in reported leaks across the top 10 ransomware groups by data volume, up 275.8%. Its April 2025–March 2026 analysis also examines Teams vishing, employee targeting and declining known ransom payments.
Key points
- Reported leak volume among the top 10 groups by data volume reached 896.2 TB, up 275.8% year over year. Rhysida and Embargo each had average and median reported leaks of at least 1 TB per victim.
- Public ransomware leak sites listed 7,366 victims, down 3%. Qilin led with 1,309 listings, followed by Akira with 708 and INC Ransom with 460; ThreatLabz identified 52 newly active groups.
- A separate one-month study of 351 employee victims across 334 organizations linked to one ransomware group found 62% held managerial titles or above. More than three-quarters worked in finance, sales, operations, HR or marketing.
- Initial access brokers combined spam bombing with Microsoft Teams calls impersonating IT support, persuading victims to grant access through Quick Assist or other legitimate remote-support tools before deploying backdoors.
- Technical case studies document GoGRPC using gRPC over HTTP/2, a Java backdoor using Google Drive for command-and-control, and Payouts King-linked Edgecution combining a headless Edge extension with a Python backdoor.
- Payment analysis with TRM Labs used Bitcoin transactions to ransomware-attributed addresses. Known payments fell 15.8% to $327.8 million, while the average payment rose 5.3%; Akira received the largest tracked total at approximately $73 million.
- The report recommends limiting access to sensitive data, monitoring privileged accounts, containing compromised identities and devices, and promptly patching exposed infrastructure to reduce lateral movement and exfiltration.
Article Details
- Publisher
- Zscaler ThreatLabz
- Report Period
- 2025-04-01 to 2026-03-31
- Scope
- Global ransomware activity, leak-site claims, employee targeting, initial-access techniques, malware analysis, exploited vulnerabilities, and known Bitcoin ransom payments.
- Sample Size
- 7,366 public leak-site victim listings; victimology analysis of 351 individuals across 334 organizations during one month; 760 recorded ransom payments.
- Key Statistics
- The 10 groups with the highest reported leak volumes collectively reported 896.2 TB, up 275.8% year over year; these figures reflect reported data leaks.
- Public ransomware leak sites listed 7,366 victims during the reporting period, down approximately 3% year over year; listings do not independently confirm incidents.
- In the one-month victimology sample of 351 individuals across 334 organizations linked to one ransomware group, 62% held managerial titles or above.
- Known ransom payments totaled $327.8 million across 760 payments, down 15.8% and 20.1%, respectively, year over year. The dataset excludes specified non-victim transfers, duplicates, and payments below $100.
- The report's narrative states that the average known ransom payment increased 5.3% to $431,995; initial ransom demands were not visible in the dataset.
- Recommendations
- Patch actively exploited vulnerabilities promptly, especially on edge devices, and use virtual patching when immediate updates are not possible.
- Require MFA, enforce least-privilege access, and increase logging and monitoring for privileged accounts.
- Segment user-to-application and application-to-application access, inspect encrypted traffic, and apply inline DLP to block unauthorized data transfers.
- Maintain encrypted, offline or otherwise isolated backups and regularly test restoration procedures.
- Train employees to recognize IT impersonation, vishing, and fake updates; maintain a ransomware response plan and exercise it through tabletop simulations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | supportadministrator[.]onmicrosoft[.]com | Fraudulent Microsoft 365 tenant domain used to impersonate IT support in a spam-bombing and Teams-vishing operation that deployed a Java-based RAT. |
MITRE ATT&CK
T1021.006 · Windows Remote ManagementThe Payouts King-linked broker moved laterally using Havoc's WinRM functionality.T1053.005 · Scheduled TaskScheduled tasks established Havoc persistence and launched headless Microsoft Edge to load Edgecution.T1059.001 · PowerShellPowerShell downloaded and executed GoGRPC and performed host, privilege, directory, and security-product discovery.T1070.003 · Clear Command HistoryThe GoGRPC deployment command deleted the PowerShell history file to reduce investigative evidence.T1098 · Account ManipulationThe broker added public keys to target accounts' msDS-KeyCredentialLink attributes to enable Shadow Credentials authentication and persistent account access.T1102.002 · Bidirectional CommunicationThe Java RAT used Google Drive files for bidirectional command-and-control through Google's APIs.T1105 · Ingress Tool TransferThe GoGRPC staging command downloaded a malware executable into the user's AppData directory.T1176 · Software ExtensionsEdgecution used a malicious Microsoft Edge extension to relay commands to a Python backdoor through native messaging.T1219 · Remote Access ToolsAttackers abused legitimate remote-access software, including Quick Assist and AnyDesk, to obtain and maintain access.T1486 · Data Encrypted for ImpactSome ransomware intrusions encrypted victim files; Payouts King combined selective file encryption with data theft.T1518.001 · Security Software DiscoveryAttackers queried Windows Security Center for antivirus products and checked for CrowdStrike Falcon before choosing an execution path.T1546.015 · Component Object Model HijackingThe Java RAT used TypeLib COM hijacking to redirect legitimate COM calls to a malicious scriptlet.T1547.001 · Registry Run Keys / Startup FolderGoGRPC persisted through a registry Run value; the Java RAT also used a startup-folder shortcut.T1566.004 · Spearphishing VoiceAttackers called victims through Microsoft Teams while impersonating IT support to induce remote access and malware deployment.T1574.002 · DLL Side-LoadingA Payouts King-linked broker used a legitimately signed Adobe Acrobat update executable to sideload a malicious msi.dll that loaded Havoc.
CVE
CVE-2023-27532• CVE-2023-27532 which targets the Veeam Backup authentication login requests to leak NetScaler memory,CVE-2024-40711• CVE-2024-40711 is a critical vulnerability that allows This vulnerability was exploited by initial access brokers tiedCVE-2024-40766VPN misconfigurations and CVE-2024-40766. This SonicWallCVE-2024-49766initial access via VPNs, using compromised credentials and exploiting CVE-2024-49766.CVE-2025-5777privilege escalation including the following: • CVE-2025-5777 (CitrixBleed 2) is a vulnerability inCVE-2025-61882targeting Oracle E-Business Suite environments, where attackers exploited CVE-2025-61882,CVE-2026-20131attacks targeting the same vulnerability or misconfiguration • CVE-2026-20131 is a critical vulnerability in enterprise
Threat Actors
AkiraAssociated with 708 leak-site victim listings and the highest known payment total. ThreatLabz reported affiliates exploiting SonicWall VPN vulnerabilities or misconfigurations.chaosRansomware-as-a-service operation believed to include former BlackSuit members. ThreatLabz tracked an associated initial access broker deploying GoGRPC.Cl0pExplicitly identified as an alternate name for Clop, which targeted enterprise applications and file-sharing platforms for data theft and extortion.ClopAlso identified as Cl0p and, in the payment table, FIN11. Linked to large-scale data-theft extortion targeting Oracle E-Business Suite and Gladinet CentreStack.DragonForceInitial access brokers tied to this ransomware operation reportedly exploited CVE-2025-5777 to hijack sessions on Citrix NetScaler appliances.FIN11The report's payment table explicitly lists FIN11 as an alternate name for Clop.INC RansomRanked third by public leak-site victim listings, with 460 listed victims and 96.6 TB of reported leaked data.InterlockThird-party reporting linked exploitation of CVE-2026-20131 in Cisco firewalls to this ransomware operation.Payouts KingRansomware group associated with brokers using spam bombing, Teams vishing, credential phishing, Havoc, and subsequently Edgecution. ThreatLabz linked its tradecraft to former Black Basta affiliates.QilinAlso known as Agenda. Ranked first with 1,309 public leak-site victim listings; ThreatLabz observed associated intrusions exploiting Veeam vulnerabilities.
Malware
Akira- [#3 Akira](#3-akira)BlindDoorThe actor also deployed a broader collection of custom malware families including tools that we named BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX.Edgecutionthat ThreatLabz named Edgecution. The threat actor also made changes to theGoGRPC- [Case study: Custom toolchains based on a new malware family named GoGRPC](#case-study-custom-toolchains-based-on-a-new-malware-family-named-gogrpc)Payouts King- [Case study: Attack evolution for an initial access broker working with Payouts King ransomware](#case-study-attack-evolution-for-an-initial-access-broker-working-with-payouts-king-ransomware)PyGRPCThe actor also deployed a broader collection of custom malware families including tools that we named BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX.Qilin- [#2 Qilin](#2-qilin)RevSocketThe actor also deployed a broader collection of custom malware families including tools that we named BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX.RSOXThe actor also deployed a broader collection of custom malware families including tools that we named BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX.S3SiphonThe actor also deployed a broader collection of custom malware families including tools that we named BlindDoor, RevSocket, PyGRPC, S3Siphon, and RSOX.
Vendors
Ciscostemming from a failure to reset local account passwords with Cisco firewalls allowing unauthenticated remote attackersCitrixCitrix NetScaler appliances that allows malformed pre-CrowdStrikeThe commands executed by the batch script then check for the presence of CrowdStrike Falcon service and alter the execution path based on the result.GladinetIn late 2025, Clop targeted internet-exposed Gladinet CentreStack file servers in a data theftMicrosoftAttackers are combining tactics like spam bombing with IT-themed Microsoft Teams vishing and abusing legitimate remote support tools to gain initial access and establish their foothold.Oracletargeting Oracle E-Business Suite environments, where attackers exploited CVE-2025-61882,SonicWalland SonicWall VPN software. Since at least August 2025, initial disclosure underscores the need to expediently patch and updateVeeamThreatLabz observed affiliates exploiting vulnerabilities in Veeam The consistent exploitation of vulnerabilities years after their initialZscaler**Organization:** Zscaler
Products
Citrix NetScalerCitrix NetScaler appliances that allows malformed pre-CrowdStrike FalconThe commands executed by the batch script then check for the presence of CrowdStrike Falcon service and alter the execution path based on the result.Gladinet CentreStackIn late 2025, Clop targeted internet-exposed Gladinet CentreStack file servers in a data theftMicrosoft 365 Apps for EnterpriseThey then create Microsoft 365 tenants with usernames and `onmicrosoft.com` subdomains that mimic IT help desk staff.Microsoft Edgethat the threat actor likely used AI to create the multiple iterations of the original batch script. Microsoft Edge, and in turn Edgecution.Microsoft Quick AssistAfter communication is established, the victim is usually instructed to provide remote access through legitimate tools such as Microsoft Quick Assist, AnyDesk, or TeamViewer.Microsoft TeamsAttackers are combining tactics like spam bombing with IT-themed Microsoft Teams vishing and abusing legitimate remote support tools to gain initial access and establish their foothold.Oracle E-Business Suitetargeting Oracle E-Business Suite environments, where attackers exploited CVE-2025-61882,Zero Trust ExchangeThe Zscaler Zero Trust Exchange™ protects thousands of customers from cyberattacks and data loss by securely connecting users, devices, and applications in any location.
Tools
Havoc*Figure 19: Example fake spam filter update website used to deploy Havoc in Payouts King ransomware attacks*RCloneXeox, JumpCloud, and AnyDesk for remote access. The threat actor then used Rclone or WinSCP to exfiltrateWinSCPXeox, JumpCloud, and AnyDesk for remote access. The threat actor then used Rclone or WinSCP to exfiltrate
Countries
Australia| Australia | 114 | 1.6% |Canadaexperienced by far the most ransomware attacks at 50.7% share—more than 10x that of any other country. Canada (4.8%), Germany (4.3%), and the United Kingdom (4.1%) followed, after which each country fell below 3%France| France | 186 | 2.6% |Germanyfar the most ransomware attacks at 50.7% share—more than 10x that of any other country. Canada (4.8%), Germany (4.3%), and the United Kingdom (4.1%) followed, after which each country fell below 3% share.India| India | 121 | 1.7% |Italy| Italy | 193 | 2.7% |Spain| Spain | 160 | 2.2% |Thailand| Thailand | 77 | 1.1% |United Kingdomat 50.7% share—more than 10x that of any other country. Canada (4.8%), Germany (4.3%), and the United Kingdom (4.1%) followed, after which each country fell below 3% share.United States- **The United States continues to bear a disproportionate share of ransomware activity:**
Industries
Accounting Services| Accounting Services | 280 |business services| Business Services | 321 |Construction| Construction | 568 |Financial Services| Financial Services | 246 |Freight & Logistics Services| Freight & Logistics Services | 132 |Healthcare| Healthcare | 508 |LegalThe more sensitive and operationally important information attackers possess, the greater the potential business, reputational, and legal consequences of its public release.ManufacturingManufacturing and technology had the highest numbers of ransomware victim organizations for the second year in a row—1,025 and 605, respectively. However, victim volume rose substantially in other sectors year overTechnologyManufacturing and technology had the highest numbers of ransomware victim organizations for the second year in a row—1,025 and 605, respectively. However, victim volume rose substantially in other sectors year overUtilitiesvictim volume rose substantially in other sectors year over year, with freight & logistics (+725%) and utilities (+622%) experiencing the largest percentage increases.