Ransomware Gangs Are Getting Leaner and Harder to Find
A new wave of criminal tools is reshaping how ransomware gangs operate, and a group called Payload shows what a focused, modern outfit looks like.
Key points
- Payload, a ransomware group Threat Vectr has tracked via its public leak site, has listed 2 victims in the past 30 days, suggesting a shift toward slower, more deliberate targeting.
- Major criminal groups now steal data before encrypting files, using the threat of public exposure to pressure victims into paying without waiting to see whether backups work.
- Lumma Stealer, StealC, and RisePro now account for 75 percent of all stolen credentials circulating on criminal markets, according to security vendor Immersive.
- AI is collapsing what was once a sprawling criminal marketplace into a smaller, cheaper operation with lower startup costs and more operators.
Ransomware, the criminal practice of breaking into a company's computer systems, locking up its files, and demanding payment to restore access, has been reengineered. The blunt, scatter-shot attacks of five years ago are largely gone. What replaced them is quieter, more patient, harder to stop.
Payload is one example of how that shift looks in practice. Threat Vectr first covered ransomware groups' use of leak sites on 4 October 2026. Those boards are where ransomware gangs post the names of victims who refused to pay. Two new Payload victims were listed in the past 30 days. These are unverified claims made by criminals, not independently confirmed breaches.
How do criminals get in now?
They buy the keys. A category of software called infostealers, programs that run silently on an infected machine and harvest saved passwords and authentication tokens (the one-time codes used to confirm your identity), has exploded. According to Immersive, three infostealer programs, Lumma Stealer, StealC, and RisePro, now account for 75 percent of all stolen credentials on criminal markets.
Rather than spending weeks breaking down a company's defences, a criminal can spend a few dollars buying login details harvested by someone else's infostealer and walk straight in through the front door. Ben McCarthy, lead cyber security engineer at Immersive, told CSO Online this shift "commoditizes initial access, enabling nation-state goals through simple transactions rather than complex attacks."
What happens once they're inside?
Modern ransomware groups don't immediately lock files. They spend days or weeks moving quietly through a company's systems, copying sensitive documents before they ever trigger the encryption that makes headlines. By the time a victim discovers the attack, the criminals already have the data. The encryption's almost a formality: the real lever is the threat to post stolen files publicly if the ransom goes unpaid.
Groups use legitimate administrative tools, the kind IT departments use every day, to move through networks without triggering alarms. Jamie Moles, senior technical marketing manager at ExtraHop, told CSO Online that adversaries are "increasingly shifting toward abusing trusted platforms" alongside these living-off-the-land techniques, routing command signals through mainstream services and hiding in traffic companies already trust.
Is AI changing this?
Yes, and not in the direction defenders would want. Researchers at Huntress describe the criminal ecosystem as being "flattened" by AI. Building custom malware once required a loose network of specialist developers: one to write the entry tool, another to build the encryption, another to manage communications. AI makes much of that specialisation unnecessary. Startup costs have dropped, which means more operators, not fewer.
Payload's quiet recent pace, two claimed victims in 30 days, is worth watching. A lower public profile sometimes means a group is restructuring. It can also mean they're simply being more careful about what they choose to publicise. Our coverage of N0n's claimed attack on a Missouri dental lab this week is a reminder that smaller, named groups are the ones driving volume right now, not the old megagangs.
Should you worry?
Manufacturing and healthcare remain the sectors these groups target most. Employees of companies in those fields who receive unexpected emails asking them to reset passwords or confirm account details should treat those messages with extra scepticism and report them to their IT team rather than clicking through. The credential-buying model means attackers may already hold valid logins before anyone inside the organisation knows there's a problem.
