Stay Ahead of Ransomware - July 2026

Threat actors are increasingly shifting away from traditional ransomware encryption, focusing instead on data exfiltration and techniques to bypass security controls like MFA and EDR 4:52-5:01.

Key Takeaways:
• Ransomware encryption has dropped to roughly 50% of cases, partly due to better backup recovery and declining extortion payments (now around 20%), with groups like Beyond Leon exfiltrating data only 8:28-9:04.
• Attackers use AiTM phishing kits (like EvilGinx) to steal session tokens, completely bypassing MFA by injecting stolen cookies to access accounts directly 19:37-22:57.
• "EDR killers" exploit vulnerable signed drivers to gain kernel access, allowing attackers to silently terminate security tools like Defender or CrowdStrike and operate undetected 26:29-31:06.
• The tool rclone is heavily abused for rapid data exfiltration, leaving behind forensic artifacts like config files (with obfuscated but easily decrypted credentials), prefetch files, and SRUM database network logs 34:44-37:01.
• Free Canary tokens (e.g., fake insurance docs, AWS keys, or tracking pixels on login pages) provide excellent, low-overhead deception-based detection for defender teams 46:05-51:09.

As the threat landscape pivots from encryption to stealthier extortion methods, organizations must evolve their defenses beyond basic MFA and backups to include phishing-resistant authentication, kernel-level driver monitoring, and proactive deception techniques.

Sources:

• 4:52-5:01 Shift away from encryption toward other extortion techniques
• 8:28-9:04 Stats on encryption drop and declining payment rates
• 19:37-22:57 AiTM phishing demo bypassing MFA via session cookie theft
• 26:29-31:06 EDR killer demo using vulnerable drivers to kill security processes
• 34:44-37:01 rclone exfiltration demo and associated forensic artifacts
• 46:05-51:09 Using Canary tokens for deception and detection