Ransomware Gangs Shifting Tactics to Evade Enterprise Defenses

Summary: Ransomware gangs are evolving their tactics in response to enhanced enterprise cybersecurity measures, with an increased focus on data theft over traditional ransomware attacks. Huntress’ 2025 Cyber Threat Report highlights a significant rise in the use of remote access Trojans and infostealer malware in 2024. This evolution signifies a concerning trend where attackers exploit gaps in data loss prevention (DLP) strategies, particularly in organizations with remote work policies.

Affected: Organizations experiencing ransomware attacks and data breaches

Keypoints :

• 75% of ransomware incidents involved the use of remote access Trojans (RATs).
• Many gangs have shifted from encryption to data theft and extortion due to improved cybersecurity defenses and law enforcement actions.
• The average time-to-ransom (TTR) has decreased significantly, with some gangs delivering ransom notes within approximately 6 hours.
• Data loss prevention (DLP) measures remain underdeveloped in enterprises, making them vulnerable to data theft tactics.
• Attackers leverage legitimate system admin tools to evade detection and optimize their attacks.