This report analyses the 2026 ransomware landscape using primary sources from CISA, the FBI, NCSC UK, and Europol — translating threat actor behaviour into actionable intelligence for security teams and business leadership.

The Ransomware Business Model — How It Actually Works

Modern ransomware operates primarily through a Ransomware-as-a-Service (RaaS) model. The structure mirrors legitimate software distribution:

Core Developer Group — builds and maintains the ransomware payload, encryption mechanisms, and payment infrastructure. Takes a percentage of every ransom payment.

Affiliate Programme — criminal actors license the ransomware, conduct their own intrusions, deploy the payload, and negotiate ransoms. Affiliates typically retain 70–80% of the ransom.

Initial Access Brokers (IABs) — a specialised criminal layer that compromises networks and sells access to affiliates. A compromised Fortune 500 network with domain admin credentials can sell for $50,000–$100,000 on underground markets.

This division of labour means a ransomware attack may involve five or more distinct criminal actors, each specialising in one phase of the operation. Attribution is consequently complex — the group named in headlines is typically the RaaS operator, not the affiliate who conducted the actual intrusion.

Key Threat Actor Groups — 2026

LockBit 3.0 and Successors

LockBit was the dominant RaaS operation through 2024, disrupted by Operation Cronos in February 2024 — a joint operation by the FBI, NCSC UK, Europol, and twelve other agencies. However, law enforcement disruption of RaaS operations historically results in rebrand rather than elimination.

Key characteristics of LockBit-lineage operations:

• Double extortion standard — data exfiltration before encryption
• Affiliate programme with aggressive recruitment
• Bug bounty programme for identifying flaws in their own malware

Reference: FBI/CISA Joint Advisory AA23-075A

ALPHV/BlackCat

Notable for being written in Rust — technically sophisticated, cross-platform, and difficult to detect. ALPHV conducted the Change Healthcare attack in early 2024, causing significant disruption to US healthcare billing infrastructure and highlighting the systemic risk posed by single points of failure in critical sectors.

Reference: CISA Advisory AA23-353A

Cl0p

Distinguished by exploiting zero-day vulnerabilities in managed file transfer software at scale — the MOVEit campaign in 2023 compromised hundreds of organisations simultaneously. This “mass exploitation” model contrasts with targeted RaaS operations and requires different defensive strategies.

Evolving Tactics — What Has Changed in 2026

Intermittent Encryption

Modern ransomware encrypts only portions of files rather than entire files — dramatically increasing encryption speed while still rendering data unusable. This reduces the time window for detection and response.

Exfiltration Before Encryption — Triple Extortion

The standard model is now:

1. Exfiltrate data — steal before encrypting
2. Encrypt systems — operational disruption
3. Threaten public disclosure — reputational damage
4. Threaten regulatory notification — compliance pressure (GDPR, HIPAA fines)

Some operations have added a fourth threat: DDoS attacks against victims who refuse to pay.

Targeting Backup Infrastructure

Ransomware operators now specifically target backup systems — identifying and destroying backups before deploying ransomware, eliminating the primary recovery mechanism. This makes offline, immutable backups non-negotiable.

Living off the Land (LotL)

Affiliates increasingly use legitimate system administration tools — PowerShell, WMI, PsExec, Cobalt Strike — to conduct intrusion and lateral movement, making detection significantly harder than signature-based approaches allow.

Business Impact Analysis — 2026

The financial impact of ransomware extends beyond the ransom itself:

The average total cost of a ransomware incident — including all categories above — significantly exceeds the ransom payment itself. Organisations that focus solely on ransom negotiation without accounting for full recovery costs systematically underestimate ransomware risk.

Sectors Under Greatest Pressure — United States & United Kingdom

Healthcare — Electronic health records, operational technology dependencies, and regulatory sensitivity make healthcare a high-value target. US healthcare has faced persistent attacks from multiple groups following the Change Healthcare incident’s demonstrated impact.

Financial Services — High-value data, regulatory notification requirements, and reputational sensitivity. UK financial services firms face dual regulatory pressure from the PRA/FCA and ICO.

Legal — Law firms hold client data across multiple industries. A single successful attack can expose data from dozens of client companies.

Manufacturing and Critical Infrastructure — OT/IT convergence creates new attack surfaces. US CISA Critical Infrastructure Security advisories frequently highlight manufacturing targeting.

Defensive Framework — Prioritised by Effectiveness

The following controls are prioritised based on their documented effectiveness in preventing ransomware intrusion and limiting blast radius:

Tier 1 — Prevent Initial Access

Multi-Factor Authentication (MFA) — The single most effective control. The majority of ransomware incidents begin with compromised credentials. MFA defeats credential-based access even when credentials are stolen. Implement on all external-facing systems without exception.

Patch Management — Maintain a patch cycle that addresses critical and high severity vulnerabilities within 72 hours of publication. Cl0p’s success demonstrates that slow patching of known vulnerabilities remains highly exploitable.

Email Security — Phishing remains a primary initial access vector. Implement DMARC, DKIM, SPF, and anti-phishing controls. Conduct regular phishing simulations.

Tier 2 — Detect and Contain

Endpoint Detection and Response (EDR) — Signature-based antivirus is insufficient. EDR with behavioural detection identifies LotL techniques that signature scanning misses.

Network Segmentation — Limit lateral movement. Flat networks allow ransomware to propagate from a single compromised endpoint to full domain compromise. Implement least-privilege network access.

Log Aggregation and SIEM — Centralised logging enables detection of lateral movement patterns, unusual authentication activity, and large-scale data exfiltration.

Tier 3 — Recover Without Paying

Immutable, Offline Backups — The 3-2-1-1-0 rule: three copies, two media types, one offsite, one offline/immutable, zero errors on restore testing. Test restores regularly — untested backups frequently fail at the moment of greatest need.

Incident Response Plan — A documented, tested IR plan reduces recovery time and cost significantly. Include ransomware-specific playbooks with decision trees for payment considerations.

Official Resources

• CISA Stop Ransomware — comprehensive US guidance
• NCSC UK Ransomware Guidance — UK-specific response guidance
• FBI Ransomware Resources — reporting and resources
• Europol IOCTA Report — EU organised cyber crime analysis
• MITRE ATT&CK Ransomware — threat actor campaign tracking

Conclusion

Ransomware in 2026 is a mature criminal industry, not a collection of opportunistic attacks. Defending against it requires understanding the business model — who the actors are, how they operate, and what controls systematically disrupt their operations.

The organisations that suffer most are those that treat ransomware as a technology problem rather than a business risk requiring board-level attention, adequate resourcing, and tested response capability.

The next report in this series covers Initial Access Brokers — the criminal layer that makes modern ransomware operations possible, and how organisations can detect and disrupt IAB activity before ransomware is deployed.

Intelligence corrections, additional sources, or sector-specific questions? Get in touch.

This guide covers OSINT from first principles to advanced methodology — the way security professionals actually use it, not the oversimplified version you find in most tutorials.

What OSINT Actually Is

OSINT is the collection and analysis of information from publicly available sources to produce actionable intelligence. The term originated in military and intelligence communities — the CIA, GCHQ, and NATO all have dedicated OSINT units — and has since become a core discipline in cybersecurity, investigative journalism, law enforcement, and corporate due diligence.

The key word is publicly available. OSINT does not involve accessing private systems, intercepting communications, or any form of unauthorised access. Everything covered in this guide operates entirely within legal boundaries when used responsibly.

Ethical Boundary: OSINT techniques must only be used on yourself, your organisation, or targets you have explicit written authorisation to research. Unauthorised collection and profiling of private individuals may violate GDPR (UK/EU), CCPA (California), CFAA (US), and Computer Misuse Act 1990 (UK).

The OSINT Framework

Before touching any tool, understand the methodology. OSINT professionals follow a structured process:

Phase 1 — Define Your Intelligence Requirement

What exactly do you need to know? Define your target and your objective before starting. Undirected collection produces noise, not intelligence.

Examples of clear intelligence requirements:

• What is the external attack surface of [organisation]?
• What personal information about [individual] is publicly accessible?
• What technologies does [company] use in their infrastructure?

Phase 2 — Passive Reconnaissance

Collect information without directly interacting with the target. No packets sent, no footprint left.

Phase 3 — Active Reconnaissance

Interact with public-facing infrastructure to gather additional data. This leaves traces and requires explicit authorisation.

Phase 4 — Analysis & Correlation

Raw data is not intelligence. Analysis — finding connections, confirming accuracy, assessing reliability — is where OSINT becomes valuable.

Phase 5 — Reporting

Document findings clearly with source attribution, confidence levels, and recommendations.

Beginner Level — Starting Points

Google Dorking

Google’s advanced search operators are among the most underutilised OSINT tools available. Used correctly, they surface information that basic searches never return.

Essential operators:

site:target.com              — limits results to a specific domain
filetype:pdf site:target.com — finds specific file types
inurl:admin site:target.com  — finds URLs containing specific strings
intitle:"index of"           — finds exposed directory listings
"@target.com" filetype:xls   — finds spreadsheets containing email addresses

Real example: site:target.com filetype:pdf "confidential" frequently surfaces internal documents accidentally published to public web servers.

Official reference: Google Search Operators Documentation

WHOIS Lookup

Every registered domain has a WHOIS record containing registration data. Even with privacy protection enabled, historical records often contain real contact details.

Tools:

• who.is — clean UI, historical records
• domaintools.com — professional-grade, tracks changes over time
• whois target.com — command line, fastest for bulk queries

What you can find: registrant name, email, organisation, registration date, name servers, registrar.

Certificate Transparency Logs

Every TLS certificate issued is logged publicly. This reveals subdomains — often including staging environments, internal tools, and forgotten infrastructure.

# Using crt.sh — free, no account required
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u

Or simply visit: https://crt.sh/?q=%.target.com

This consistently surfaces subdomains that DNS brute-forcing misses entirely.

Intermediate Level — Infrastructure Intelligence

Shodan

Shodan is a search engine for internet-connected devices. It continuously scans the entire internet and indexes banners, service versions, open ports, and SSL certificates.

What security professionals use it for:

• Finding exposed databases (MongoDB, Elasticsearch, Redis)
• Identifying outdated software versions in production
• Mapping an organisation’s full external attack surface
• Finding industrial control systems (ICS/SCADA) exposed to the internet

# Shodan search examples
org:"Target Company Ltd"          — all assets belonging to an organisation
ssl:"target.com"                  — assets with target.com in SSL certificate
port:3389 country:GB              — exposed RDP servers in the UK
product:"Apache httpd" version:2.2 — vulnerable Apache versions

Official resource: Shodan Documentation

According to CISA’s 2025 advisory on internet-exposed assets, exposed management interfaces remain one of the top vectors for initial access in ransomware attacks.

theHarvester

A purpose-built OSINT tool for gathering emails, subdomains, and employee names from public sources.

# Installation
pip install theHarvester

# Basic usage
theHarvester -d target.com -b google,bing,linkedin,shodan -l 500

Sources it queries: Google, Bing, LinkedIn, Hunter.io, Shodan, and more. Produces a consolidated list of email addresses, names, and infrastructure details.

Maltego

Maltego is the professional standard for OSINT data correlation. It visualises relationships between entities — people, organisations, domains, IP addresses, social accounts — through an interactive graph.

Community edition is free. Professional licence is used by law enforcement agencies, corporate investigators, and penetration testers worldwide.

Key transforms for security research:

• Domain → DNS records → IP addresses → hosting provider
• Email address → breached credentials → associated accounts
• Organisation → employees → LinkedIn profiles → personal emails

Advanced Level — Social Media Intelligence (SOCMINT)

Metadata Extraction from Images

Every image taken on a smartphone contains EXIF metadata — which can include GPS coordinates, device model, software version, and timestamp.

# Using ExifTool — the standard for metadata extraction
exiftool image.jpg

# Extract GPS coordinates specifically
exiftool -gpslatitude -gpslongitude image.jpg

This is how journalists and investigators have geolocated conflict zone images, verified the location of leaked documents, and identified the devices used to capture specific photographs.

Defensive note: Strip EXIF data before publishing any images using tools like ExifTool or online services like exifpurge.com.

Reverse Image Search — Beyond Google

Google reverse image search is the starting point, but advanced OSINT uses multiple engines simultaneously:

Breach Data Intelligence

Have I Been Pwned (HIBP) is the authoritative public resource for checking whether an email address appears in known data breaches.

• haveibeenpwned.com — individual lookups
• HIBP API — programmatic bulk checking for organisations

For security professionals conducting authorised assessments, breach data reveals credential reuse patterns — one of the most dangerous vulnerabilities in any organisation.

Reference: Troy Hunt’s HIBP database currently contains over 14 billion breached records. NCSC UK recommends HIBP as part of password security policy.

OSINT Tool Reference — Complete List

Defending Against OSINT

Understanding OSINT is only half the picture. The other half is protecting your organisation from being the target.

For organisations:

1. Conduct regular attack surface reviews using the tools above
2. Audit what employee information is publicly visible on LinkedIn
3. Implement strict email format policies to reduce harvesting
4. Remove sensitive metadata from all published documents and images
5. Monitor certificate transparency logs for unexpected subdomains
6. Use Google Alerts for your organisation name and key personnel

For individuals:

1. Audit your own digital footprint quarterly
2. Enable privacy protection on domain registrations
3. Strip metadata from images before publishing
4. Review and restrict social media visibility settings
5. Check yourself on HIBP regularly

Official Resources & References

• OSINT Framework — comprehensive tool directory
• NCSC UK — Protective DNS
• CISA — Reduce Internet-Facing Attack Surface
• ENISA Threat Landscape 2025
• BSI Germany — IT Grundschutz
• Have I Been Pwned API Documentation

Conclusion

OSINT is not a collection of hacking tricks. It is a disciplined intelligence methodology that, when applied rigorously and ethically, gives security professionals a complete picture of what an attacker can learn about a target before launching an attack.

Master the basics — Google dorking, WHOIS, certificate transparency — before moving to advanced tools. The most impactful OSINT finds consistently come from the simplest techniques applied thoughtfully.

The next article in this series covers Social Engineering Attack Patterns — how attackers use OSINT intelligence to build targeted phishing and pretexting campaigns.

Have corrections, additions, or want to share your own OSINT research? Get in touch.