Ransomware is the defining cybersecurity threat of the 2020s. In 2026, attacks have become more sophisticated, more targeted, and more expensive than ever. The average ransom payment has crossed $2.3 million. The average total cost of a ransomware incident — including downtime, recovery, legal fees, and reputational damage — is $4.9 million. And the average time to detect a ransomware attack before encryption begins is still 24 days.

This guide explains how modern ransomware attacks work, who is behind them, which industries are most targeted, and the specific technical and organisational controls that are most effective at preventing and recovering from attacks.

How Modern Ransomware Attacks Work

Modern ransomware attacks follow a predictable playbook that security researchers call the "attack chain." Understanding each stage is essential for building effective defences.

Stage 1: Initial Access. Attackers gain entry through phishing emails (the most common vector, accounting for 41% of initial access), compromised credentials purchased on dark web marketplaces, exploitation of unpatched vulnerabilities in internet-facing systems (particularly VPNs, RDP, and web applications), or supply chain compromises through trusted third-party software.

Stage 2: Persistence and Lateral Movement. Once inside, attackers establish persistence — ensuring they can maintain access even if the initial entry point is closed — and begin moving laterally through the network. This phase typically lasts weeks or months. Attackers use legitimate tools like PowerShell, WMI, and remote administration software to avoid detection, a technique known as "living off the land."

Stage 3: Privilege Escalation. Attackers escalate their privileges to gain administrative access to critical systems. Common techniques include exploiting misconfigured Active Directory, credential dumping with tools like Mimikatz, and exploiting unpatched local privilege escalation vulnerabilities.

Stage 4: Data Exfiltration. Before deploying ransomware, sophisticated groups exfiltrate sensitive data — customer records, financial information, intellectual property — to use as additional leverage. This "double extortion" approach means victims face both the threat of operational disruption and the threat of data exposure.

Stage 5: Ransomware Deployment. Only after thorough reconnaissance do attackers deploy the ransomware payload. The timing is typically chosen to maximise damage — often on weekends or public holidays when IT staff are less available. The ransomware encrypts files across the network, deletes shadow copies and backups, and displays a ransom note with payment instructions.

The Major Threat Actors in 2026

Ransomware is no longer the domain of individual hackers. The most sophisticated groups operate as professional criminal enterprises with HR departments, customer service teams, and affiliate programmes.

LockBit 4.0 is the most prolific ransomware group of 2026, responsible for approximately 25% of all publicly disclosed attacks. Despite law enforcement takedowns of its infrastructure in 2024, the group rebuilt and relaunched with improved capabilities. Its ransomware-as-a-service (RaaS) model allows affiliates to deploy attacks without technical expertise, dramatically lowering the barrier to entry.

ALPHV/BlackCat uses a Rust-based ransomware that is cross-platform (Windows, Linux, VMware ESXi) and highly customisable. The group is known for targeting healthcare organisations and has been responsible for several high-profile attacks on US hospital systems.

Cl0p specialises in exploiting zero-day vulnerabilities in enterprise file transfer software. Its 2023 MOVEit campaign compromised over 2,000 organisations worldwide. In 2026, the group has shifted to targeting cloud storage and backup systems.

Most Targeted Industries

Healthcare is the most targeted sector, accounting for 21% of ransomware attacks in 2026. The combination of sensitive data, critical operations, and historically underfunded IT security makes healthcare organisations attractive targets. Manufacturing (18%), financial services (14%), and education (12%) round out the top four.

Small and medium businesses are increasingly targeted. The average ransom demand for SMBs is lower ($150,000–$500,000) than for large enterprises, but the attacks are more automated and require less attacker effort. Many SMBs lack the security controls and incident response capabilities to recover without paying.

How to Protect Your Organisation

Backups — The Most Important Control: The 3-2-1 rule — three copies of data, on two different media types, with one copy offsite — remains the most effective defence against ransomware. Critically, backups must be tested regularly (many organisations discover their backups are corrupted only when they need them) and kept offline or air-gapped to prevent ransomware from encrypting them too. Cloud backups with immutable storage (where files cannot be modified or deleted for a defined period) are increasingly the standard.

Patch Management: The majority of ransomware attacks exploit known vulnerabilities for which patches exist. Applying critical patches within 24 hours of release eliminates the most common attack vectors. Prioritise internet-facing systems — VPNs, RDP, web applications — which are the most common initial access points.

Multi-Factor Authentication: MFA on all remote access systems prevents credential-based attacks, which account for 40% of initial access vectors. Phishing-resistant MFA (hardware security keys or passkeys) is significantly more effective than SMS-based MFA, which is vulnerable to SIM swapping.

Network Segmentation: Dividing your network into segments limits lateral movement. An attacker who compromises one segment cannot automatically access others. Critical systems — backups, domain controllers, financial systems — should be in isolated segments with strict access controls.

Endpoint Detection and Response (EDR): Modern EDR tools detect ransomware behaviour — mass file encryption, shadow copy deletion, unusual process activity — before the attack completes, enabling containment. CrowdStrike Falcon, SentinelOne, and Microsoft Defender for Endpoint are the leading enterprise EDR solutions.

Security Awareness Training: Since phishing is the most common initial access vector, training employees to recognise and report phishing attempts is one of the highest-ROI security investments. Regular simulated phishing exercises measure and improve employee awareness.

If You're Attacked: The First 24 Hours

Isolate affected systems immediately — disconnect from the network to prevent further spread. Do not pay the ransom without consulting a specialist incident response firm and legal counsel — payment does not guarantee decryption, funds criminal operations, and may violate sanctions regulations if the group is on a government sanctions list.

Contact the Australian Cyber Security Centre at cyber.gov.au and a specialist incident response firm (CrowdStrike, Mandiant, or a local MSSP). Preserve forensic evidence — do not wipe systems before investigators have had a chance to collect evidence. Restore from clean backups, starting with the most critical systems.

Sources & Further Reading