Europol ¦ How Ransomware is Evolving

From encryption to extortion, alliances, and AI: a changing criminal business model

Ransomware is no longer defined only by file encryption and a demand for payment. The model has become more adaptive, more commercial, and more collaborative. Criminal groups have refined their tactics in response to stronger defenses, better backups, improved awareness among employees, and faster incident response. As a result, the focus has shifted in many cases from locking systems to stealing data, threatening exposure, and extracting leverage in other ways.

This shift matters because it shows a broader pattern in financial crime: when one pressure point weakens, offenders move to the next. Encryption once delivered fast pressure on victims. That advantage is less reliable today. Data theft, extortion, insider recruitment, and multi-group cooperation have taken its place in many campaigns. The ransomware economy has not weakened – it has adapted.

From one-off crews to an underground service market

The old image of a lone hacker building malware from scratch is outdated. Ransomware is now supported by an underground ecosystem in which tools, access, infrastructure, and expertise can be bought, rented, or shared. This lowers the barrier to entry. A person does not need to be highly skilled in every part of an intrusion to take part in it.

Ransomware as a service is a central part of that model. In its open form, almost anyone who can pay can become an affiliate. More controlled variants use invite-only access, vetting, or skill checks to limit who gets in. Closed groups operate differently again. They are tighter networks, often built on long-standing trust, sometimes stretching beyond the online space. These groups are harder for law enforcement to penetrate because they share fewer tools, reveal less, and tend to target high-value victims with greater care.

This structure is also why ransomware remains attractive: it is scalable. Offenders can split roles, distribute risk, and reuse infrastructure across campaigns. They can also absorb disruption. When one brand is taken down or becomes too visible, another can appear quickly.

Bastian Schwind-Wagner _Follow

"Ransomware has moved far beyond simple file encryption. Criminal groups are relying more on data theft, insider recruitment, and alliances that combine social engineering, lateral movement, and extortion into a more flexible business model.

That shift reflects a wider pattern in cybercrime: offenders adapt quickly when defenses improve. For organizations, the priority is no longer just recovery after encryption, but stronger identity controls, staff awareness, and rapid detection of suspicious data movement."

Collaboration is becoming more important

One of the most notable developments is the rise of cooperation between groups that were once seen as separate. Criminal alliances allow offenders to combine strengths. One group may specialize in social engineering, another in lateral movement across a network, and another in data exfiltration and monetization. Together, they can run a more complete operation.

This kind of cooperation changes the threat picture. It means that ransomware investigations are no longer about a single actor or a single malware family. They are about fluid networks of people who move between roles, reuse contacts, and share techniques across different types of cybercrime. The same individuals may also appear in fraud, SIM swapping, credential theft, or other online offences. That overlap makes investigations more complex and demands close coordination across disciplines.

It also means the line between financially motivated crime and other forms of cyber activity is increasingly blurred. Some campaigns are not only about profit. They may also be linked to political pressure, disruption, or broader strategic aims.

Social engineering is taking a bigger role

As employee awareness improves, ransomware actors are adapting their entry methods. Phishing remains important, but there is growing interest in more direct forms of social engineering. That includes attempts to bribe insiders or persuade employees to sell credentials. In practice, this can be more efficient than trying to break through strong technical defenses.

This trend makes awareness training more important than ever. Employees need to understand not only how to spot suspicious links or fake login pages, but also how insider recruitment can begin. A message asking for a small favor, a promise of easy money, or an attempt to exploit personal pressure can all be part of a wider intrusion chain.

The role of the insider is especially concerning because it can bypass many technical controls. If a legitimate account is compromised or willingly handed over, criminals may gain a route into systems that would otherwise be difficult to access.

Why encryption is giving way to data theft

The move away from encryption is largely a response to stronger defensive capabilities. Many organizations have improved backups, segmentation, and recovery procedures. Some systems can detect suspicious encryption behavior early and isolate affected devices before an attacker reaches the whole network. That makes traditional ransomware less reliable as a pressure tool.

Data theft changes the dynamic. If criminals can extract sensitive information, they do not need to shut down operations to create fear. They can threaten to leak the data, sell it, or use it to damage reputation. In many cases, the threat of exposure is enough to pressure a victim into paying.

This also makes extortion more flexible. A victim may still be able to recover systems quickly, but that does not solve the problem of stolen data. For companies, the risk is not only operational disruption. It is also legal exposure, reputational damage, regulatory scrutiny, and possible loss of customer trust.

AI is speeding up the threat

Artificial intelligence is already influencing both sides of the fight. For defenders, AI can support detection, analysis, and response. It can help sift through large amounts of security data and identify patterns faster than manual methods alone. That is encouraging.

For criminals, AI lowers friction and increases scale. It can help with phishing content, malware development, language adaptation, and other steps that make attacks faster and more convincing. That matters because ransomware is a volume game. If offenders can improve speed and quality at the same time, they can launch more campaigns with less effort.

The result is likely to be more automation, more personalized social engineering, and faster adaptation when defenses change. The challenge for law enforcement and security teams is to keep decision-making and authorization fast enough to match the pace of abuse without losing oversight.

Distributed denial of service is also part of the picture

Ransomware is not the only tactic that deserves attention. Distributed denial of service attacks remain relevant, both as a disruption tool and as an entry point into a criminal career. In many cases, the technical impact is limited because organizations have mitigation services in place. Requests can be rerouted, absorbed, or filtered before they cause real damage.

The wider impact is often psychological and political. These attacks can be used to create the impression that institutions are overwhelmed or vulnerable, especially when media coverage amplifies the event. Some groups use them as a form of protest or ideological pressure, but that does not make them legitimate. They remain criminal acts when they are used to disrupt services or support broader hostile activity.

International cooperation is essential here because these campaigns often involve participants across multiple countries. Some people may join voluntarily for ideological reasons, while others may be recruited into a wider network. The response must therefore combine technical disruption, arrests where appropriate, and clear messaging that this behavior carries consequences.

What this means for defenders

For organizations, the lesson is clear: ransomware defense is no longer just about blocking encryption. It requires a layered approach that covers identity protection, access control, data loss prevention, employee training, backup resilience, and rapid detection of unusual behavior. It also requires attention to insider risk and social engineering, not only malware.

For investigators, the challenge is equally clear. The criminal market is fragmented in some ways and tightly connected in others. Open ransomware services, semi-closed affiliate structures, and closed trust-based groups all coexist. Alliances form and dissolve quickly. Tools are reused. Brands are rebranded. That means investigations must be flexible, international, and supported by both public and private expertise.

The broader financial crime lesson is that criminal business models survive by adapting to pressure. Ransomware has done exactly that. It is less dependent on encryption than it used to be, more reliant on theft and extortion, and more willing to exploit human weakness, partnerships, and automation. That evolution is unlikely to stop.

Dive deeper

• Europol, The evolving threat landscape. How encryption, proxies and AI are expanding cybercrime – Internet Organised Crime Threat Assessment (IOCTA) 2026, Publications Office of the European Union, Luxembourg, 2026. ¦ Link