{"id":36878,"date":"2026-10-10T03:03:35","date_gmt":"2026-10-09T16:03:35","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/ransomware-extortion-without-encryption\/36878\/"},"modified":"2026-10-10T03:03:35","modified_gmt":"2026-10-09T16:03:35","slug":"ransomware-extortion-without-encryption","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/ransomware-extortion-without-encryption\/36878\/","title":{"rendered":"New ransomware trends: hijacking Active Directory instead of encrypting data"},"content":{"rendered":"

Many businesses still fear ransomware attacks. But is this threat still as relevant today? A few years ago, at the peak of ransomware\u2019s popularity, the term \u201cransomware\u201d was practically synonymous with malicious encryption of data. But in reality blocking access to information had long been little more than a symbolic gesture. In a May Securelist post<\/a> on shifts in the ransomware threat landscape, our experts noted that in 2026, attackers are encrypting company data for ransom less and less frequently. Here\u2019s a striking example: while investigating an incident, Kaspersky\u2019s Global Emergency Response Team (GERT) uncovered the PAYLOAD extortion campaign, whose operators didn\u2019t even bother using ransomware. They took a different route instead.<\/p>\n

In this campaign, instead of using ransomware, the attackers seized control of the Active Directory environment, and created a malicious group policy object (GPO). They used it to deploy a ransom note, change wallpapers, and lock screens on workstations, and set up a banner to display at system login. Naturally, they also disabled local administrator accounts while they were at it. This move let the attackers demonstrate their presence in the compromised infrastructure and prove they\u2019d accessed confidential information\u00a0\u2014 just as effectively as encryption would have. Detailed information about this incident, along with indicators of compromise, can be found in the same Securelist post<\/a>. What interests us more, though, is the trend of abandoning encryption.<\/p>\n

Why data encryption has lost relevance<\/h2>\n

Let\u2019s start with the fact that in a large company with thousands of infected computers, decrypting data is an extremely effort-intensive process. Restoring data from backups, which has become common practice largely thanks to mass ransomware attacks, is far easier than waiting for criminals to hand over a key, hoping it\u2019s genuine, and trusting that the ransomware itself didn\u2019t have bugs that made the data unrecoverable. As a result, cybercriminals found it harder and harder over time to actually collect a ransom for the decryption key.<\/p>\n

Attackers tried to adapt to this shift. Alongside encryption, they increasingly began stealing confidential data and threatening to publish it. Publishing confidential information puts a company\u2019s reputation, its security, and the safety of its business partners at risk. This is especially true if the data includes people\u2019s personal information: more than 140 countries<\/a> around the world have data protection laws, so a leak puts an organization at a fairly high risk of a hefty fine. Sometimes that\u2019s far scarier than simply losing data, and no backup can help with that.<\/p>\n

Data exfiltration has another advantage from the attackers\u2019 perspective: it\u2019s usually much harder to detect than malware activity. File encryption, for instance, triggers a spike in disk activity that endpoint protection tools pick up fairly quickly. By contrast, data exfiltration is easy to disguise as normal traffic. This is precisely what the ShinyHunters group exploits, building its attacks<\/a> around the standard OAuth mechanism. On top of that, attackers can steal data much quicker if they don\u2019t bother with encryption, which also makes it harder to catch the threat in time.<\/p>\n

As a result, encryption has become a kind of calling card \u2014 proof that the attackers had access to the data. So cybercriminals finally decided to drop this optional step altogether.<\/p>\n

What businesses should do<\/h2>\n

Standard cyberhygiene practices can help protect against a wide range of extortion schemes \u2014 regardless of whether or not they involve encryption:<\/p>\n