Exfiltration-Only Extortion Jumped 450%, and Your Encryption Alarms Won't Catch It

Between the third and fourth quarters of 2025, one class of ransomware attack grew 450 percent. It was the quiet kind. Cyber-insurer At-Bay tracked a 450 percent surge in extortion attacks that never deploy an encryptor at all. The operators break in, copy the data out, and threaten to publish it. There is no ransom note on a locked share, no mass file-rename storm, no CPU spike from a crypto routine burning through a file server. By the time most teams find out, the data is already staged on a leak site with a countdown clock next to it.

I spend my days in detection engineering, and the tooling most small teams own was built for the loud version of this attack. It watches for the encryptor: the sudden rename of thousands of files, the shadow-copy deletion, the ransom note dropping into every folder. Strip the encryption out and that entire alarm system goes dark. The intrusion still happened, the data still left, and the extortion email still lands - but nothing your endpoint agent was tuned to catch ever fired.

Why the crews put down the locker

Encryption was always the expensive part of the operation. Building a reliable locker and a working decryptor is real engineering, and getting it wrong means the victim pays and still cannot recover, which kills the crew's reputation on the next negotiation. The economics stopped justifying that cost. Kaspersky's State of Ransomware 2026 report notes the share of victims who actually pay a ransom fell to 28 percent in 2025 (a figure Chainalysis first reported). When fewer than a third of targets pay, spending weeks perfecting an encryptor is a bad trade.

Pure data theft is cheaper to run and harder to survive. There is no locker to maintain, no decryptor to ship, and the barrier to entry drops far enough that inexperienced operators can join. At-Bay's researchers make the point plainly: without encryption, there is no technical failure point for the victim to notice, and the attack generates less immediate noise, so the crew keeps access longer before anyone realizes what happened. In one case they documented, a threat actor sat inside the network for roughly six months, exfiltrating data in mid-August after an initial compromise back in mid-February.

This is a documented direction of travel, not a forecast. CISA and the FBI's joint advisory on BianLian records that the group moved to exclusively exfiltration-based extortion around January 2024, dropping encryption entirely. At-Bay names PEAR Team, Genesis, Kyber, Coinbase Cartel, and Radiant among the newer crews built around data theft, with established names like Clop and ShinyHunters running the same play. The average ransom demand they observed in these cases sat near 550,000 dollars.

Who this actually affects

Here is the relevance verdict, because it drives everything below. If your ransomware plan is a tested backup plus an endpoint agent that screams when files start encrypting, this shift is aimed straight at you. A backup restores files; it does nothing about a copy of your customer database sitting on someone else's server. The one environment that can read this with mild interest instead of urgency is the rare shop already baselining its outbound data volume and alerting on bulk transfers to cloud storage. Almost nobody is that shop, which is exactly why the 450 percent line exists.

The people who get the 2 a.m. call change too. An encryption event is an IT problem first: restore, rebuild, get operations back. A pure theft is a legal and regulatory problem from minute one. Whoever answers your breach-notification obligations, and whatever cyber-insurer underwrites you, is now in the incident before the technical team has finished scoping it. Manufacturing alone absorbed more than 18 billion dollars in ransomware-related losses in the first three quarters of 2025, and a growing share of that is data-exposure liability rather than downtime.

What data theft looks like on the endpoint

The good news for defenders is that stealing a lot of data still leaves marks, just different ones. Before it leaves, the data usually gets collected and compressed. Attackers reach for the same handful of tools repeatedly: rclone to sync to a cloud remote, WinSCP and FTP for classic transfer, 7-Zip to stage archives, and MegaCmd for Mega storage. BianLian's own toolkit, per the CISA advisory, runs on Rclone, FTP, and Mega. If you can see process execution, you can hunt for the staging step.

This Microsoft Defender / Sentinel query surfaces the copy-and-stage behavior on managed endpoints. Tune the exclusion list to your real backup tooling first, or it will bury the signal in noise:

// Exfiltration staging: mass-copy and cloud-sync utilities on endpoints
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("rclone.exe","winscp.exe","megacmd.exe","rsync.exe","7z.exe","7za.exe")
    or ProcessCommandLine has_any ("rclone","--transfers","--multi-thread","mega:","b2:","copyto")
// baseline and exclude your sanctioned backup / sync jobs before trusting this
| where InitiatingProcessAccountName !in~ ("svc-veeam","svc-backup")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

Where to point it first

• File servers and anything hosting the customer database, source repositories, or finance records. Staging happens where the data lives.
• Jump hosts and admin workstations, where an operator using stolen credentials is most likely to run transfer tooling.
• Any host where rclone or MegaCmd appears and you did not install it. Legitimate presence of these on a random workstation is rare enough to be worth a look every time.

What it looks like on the wire

The endpoint view misses managed transfers off appliances, NAS boxes, and anything without an agent, which is precisely where quieter crews aim. The network view catches what the endpoint cannot. You are looking for a host that suddenly ships far more data outbound than it ever has, usually to a cloud-storage or file-transfer destination it has never talked to.

If you have firewall or proxy logs in a SIEM, baseline per-host egress and alert on the outliers. This Splunk search flags any internal host pushing more than half a gigabyte outbound to an external destination in a day, which is already generous for most small environments:

index=firewall action=allowed
| where NOT cidrmatch("10.0.0.0/8", dest_ip)
    AND NOT cidrmatch("172.16.0.0/12", dest_ip)
    AND NOT cidrmatch("192.168.0.0/16", dest_ip)
| stats sum(bytes_out) AS total_out by src_ip dest_ip dest_port
| eval mb_out = round(total_out/1024/1024, 1)
| where mb_out > 500
| sort - mb_out

Half a gigabyte is a starting threshold, not a rule. Run it against a normal week, learn what your backups and legitimate SaaS syncs look like, then tighten it and add the destinations worth alarming on: consumer cloud storage, paste sites, and transfer services no business process uses. A host that has averaged a few megabytes a day for a year and then pushes several gigabytes to an unfamiliar address is the whole game.

The way in is still a stolen login

None of the exfiltration matters if the operator never gets in, and the entry point has been consistent. BianLian's documented initial access is compromised Remote Desktop Protocol credentials. The pattern across these crews is the same boring set of doors: exposed RDP, a VPN without phishing-resistant multi-factor authentication, and service accounts with passwords that never rotate. The exploit-of-the-week gets the headlines; the stolen or sprayed login does the work.

For a small team, the highest-value controls here are unglamorous and cheap. Put multi-factor authentication on every remote entry point, not just email. Get RDP off the public internet entirely and behind a gateway. Watch your identity logs for the tell that precedes exfiltration: a login from an unfamiliar location, an impossible-travel pair, or a dormant service account that suddenly authenticates interactively. On Red Hound engagements those three signals show up in the access logs well before any data moves, and almost nobody is watching them. Pipe those authentication events into the same SIEM as your egress data so one analyst can pivot from a suspicious login straight to the transfer it enabled, instead of chasing two half-stories in two consoles.

Baseline your egress before the next leak-site countdown

The task this quarter is a deliberate reframing of what your alarms watch. Assume the next intrusion never encrypts anything, and ask a blunt question of your own environment: if an attacker copied your most sensitive database out to an address you have never seen, which log would catch it, and who would read that log tonight? If the honest answer is that nothing would, you have found the gap that the 450 percent number is filling. Stand up per-host egress baselining, hunt for the staging tools on the servers that hold real data, and put your remote access behind phishing-resistant MFA. Then run a tabletop on the theft-only scenario specifically, because the restore-from-backup muscle everyone has drilled does nothing when there is nothing locked to restore.

If you want a second set of eyes on where your data could walk out unnoticed, that is the work we do. Red Hound builds exfiltration detection and tests the incident-response plan against the theft-only scenario, not just the encryption one, so the alert fires while the attacker is still staging rather than after the leak-site post.