A cyber threat that still ranks first in 2025 is ransomware, and its newest form is triple extortion. Attackers encrypt data, threaten to leak it, and pressure clients, vendors or regulators to push the victim to pay. This post explains how triple extortion works, which ransomware-as-a-Service groups operate, how attackers get in, and why backups alone do not give resilience.
Introduction: Why 2025 is Still the Year of Ransomware
In 2025, ransomware is still the number one cyber threat. Despite increased investment in cybersecurity tools and incident response, every sector is still at risk from ransomware attacks. The type of techniques and level of sophistication is maturing. The ransomware ecosystem is becoming more organized in who the attackers are and how they operate.
Ransomware is no longer done as an individual effort. As mentioned before, cyber criminals have begun to work together or for another party known as a Ransomware-as-a-Service (RaaS). This is a large distributed network of threat actors with distinct roles as this allows threat actors to have specialized expertise. For example, some threat actors specialize in initial access, while others specialize in delivering the payload. The biggest challenge is now the attacker negotiating a successful ransom and then the actor turning to extortion.
The latest changes in these threats is called triple extortion. Attackers were no longer restricting their methods to just encryption or extortion. They started combining these two elements. They also threatened victims with leaking their sensitive data. And they used third parties like clients, vendors, or regulators to put pressure on victims to pay the ransom.
In this blog, we look at how triple extortion works and who the major threat actors are in 2025. We also look at why so many organizations still fail to respond well to these threats, even though they clearly recognize them.
What is triple extortion and how does it work today?
Triple extortion is the most recent development in the progression of ransomware tactics. Originally, attackers encrypted a victim’s data and demanded payment for it to be decrypted. This evolved into what we now know as double extortion. Attackers still encrypted whatever financial, technological or operational data they had compromised. But they also said they would leak the stolen data if the ransom was not paid. See also the F5 nation-state breach incident page.
State-sponsored ransomware attacks and “states of emergency” due to cyber events are now also in public view with the introduction of triple extortion in 2025.
With this plan of action, attackers bring in extra pressure from outside parties. These are the breached organization’s clients, partners, suppliers and, in some cases, regulators. The aim is to raise the psychological pressure on the targeted organization.
| Aspect | Double extortion | Triple extortion |
|---|---|---|
| Pressure used | Encryption plus a threat to leak stolen data | Encryption, a leak threat and pressure from outside parties |
| Who is contacted | The victim | Clients, partners, suppliers and in some cases regulators |
Typically a triple extortion campaign goes like this:
1. Infiltration: Attackers create access through phishing emails, compromised credentials and vulnerable systems.
2. Data exfiltration: Sensitive information is stolen often prior to the encryption.
3. Encryption: Critical systems and files are locked, causing operations to halt.
4. Multi-Channel Extortion: Threats are made via a dark web post, emails to customers or partners, and/or leaking information to the media.
5. Escalation: Attackers may also threaten DDoS attacks or contacting board members directly.
This model will increase the chances of the attack victim paying a ransom demand. In the age of regulators and losing customer trust the cost-benefit analysis may force organizations to pursue a ransom. This approach also challenges the traditional ransomware playbook. All affected teams (legal, communications, leadership, IT) must work together effectively while outside parties are pressing them.
Major Ransomware-as-a-Service Groups Operating in 2025
The Ransomware-as-a-Service model has morphed into the preeminent modus operandi for most ransomware campaigns. As of 2025, many high-profile RaaS groups remain a threat. They let less skilled affiliates run complex attacks with rented ransomware kits and supporting infrastructure.
Important groups acting in 2025 include:
LockBit 3.0: Number one in persistence, always looking for adaptive patterns to modify their products faster than other RaaS groups. LockBit continues to offer modular payloads, and affiliate programs, and has automated negotiation portals. Global targets include both the public and private sector.
ALPHV (BlackCat): provides advanced power of encryption routines and clichéd multi-platform support. BlackCat affiliates frequently use double or triple extortion strategies and maintain a public leak site. The site includes searchable content on past and current victim data. CISA notes that law enforcement disrupted the group’s infrastructure in December 2023, so this source does not confirm activity in 2025 (CISA AA23-353A).
Black Basta: Active since 2022 and a possible descendant or updated version of Conti. Black Basta’s targets include large enterprises and initial access brokers before ransomware affiliates. In 2025, Black Basta has determined stealthier methods of delivery while recognizing that their focus should be on healthcare, finance, and manufacturing. CISA reports that Black Basta affiliates have encrypted and stolen data from at least 12 of 16 critical infrastructure sectors, including healthcare (CISA AA24-131A).
New or Emerging Actors: Groups include RA Group, Akira, and 8Base who can generate new revenue, with affiliates committed to aggressive pricing. Some actors invest modestly to claim territory or target patients in underserved regions. Others experiment with highly customized extortion campaigns that avoid remote access tools, for example by contacting regulatory agencies directly.
How do ransomware groups get in, and why do defenses fail?
Awareness of cybersecurity is higher and organizations invest more in security. Even so, weak basic security hygiene and vulnerabilities known to the security community let ransomware actors carry on. Entering 2025, a successful ransomware campaign starts with one or more of these entry points:
1. Phishing and Social Engineering
Credential harvesting via spearphishing is still the primary vector of choice for attackers. The attackers send emails built to look like they come from a trusted source. The theme is often a common online form, such as invoices, receipts, legal threats, and internal HR functions.
2. Vulnerabilities Exploited in Publicly Facing Applications
Unpatched systems are a favorite target for ransomware groups. Systems that give attackers easy access include VPNs, remote access software like Team Viewer, and the WordPress CMS. Attackers also exploit zero-day vulnerabilities and APIs that are not protected.
3. Use of RDP and VPNs
Misconfigured RDP exposed to the internet is a common way in. It is often set up with only minimal security access, including MFA that can be bypassed. Stolen VPN credentials acquired through phishing are another way in. There are still many brute-force attacks on VPNs.
4. Accessbroker
Ransomware groups use Initial Access Brokers (IAB) on dark web markets, which are generally verified access to corporate networks. Ransomware as a service (RaaS) sells betrayed verified corporate network access, and would-be attackers have more cause to expend energy on breaches.
Reasons why defenses fail:
Limited visibility: Unsophisticated behavioral analytics or SIEM correlation can allow lateral movement to go unnoticed.
Networks left unsegmented: Flat networks can easily allow ransomware to spread.
Backups not usable: Only a few backups are isolated, encrypted, or regularly tested; some are deleted or encrypted during an attack.
Weaknesses persist despite being documented just like defenses are exploited, organizations that don’t act on recognized risks are always targets.
Why is resilience the weak link beyond backups?
Many organizations now have a backup solution and, at least in 2025, resilience against ransomware will require more than restoring data. Attackers have adapted, and so must the defenders. Resilience means rebuilding data and infrastructure, maintaining business continuity and reputational trust, and minimizing financial and regulatory impacts.
1. Attackers Are Now Targeting Backups
Modern ransomware searches for backups and actively deletes them. This is especially true for backups connected to the primary systems and for poorly secured cloud storage. If organizations are not using backups that are isolated (offline or immutable) their backups are effectively useless for recovery purposes during the attack.
2. Recovering Takes Time and Coordination
Most of us need backups, and we will run into storage limits. Even organizations with well-structured backups will take several days to weeks to restore their critical systems. Most organizations under-estimate the rebuilding time needed to restore applications, re-configure the systems involved, and validate the integrity of the information. While systems are down so are revenues, operational activities, and reputational trust with customers.
3. Resilience Requires a More Holistic Approach
- Immutable (write-friendly) backups that are incapable of alteration once written
- Air-gapped data storage, which is incomplete removed from the production systems
- Disaster Recovery Plans that include at least people, process, and communications
- Business impact assessments to rank which areas should recover to speed up processes to cut down long-term impact
- Incident response playbooks as it relates to a ransomware attack
4. Mean time to restore (MTTR) is a driving metric
Organizations are starting to measure resilience in the form of MTTR. A low MTTR means that nothing was ever missed; however, it also means that this recovery has been practiced, rehearsed, and is automatic.
By 2025, resilience means being able to absorb a ransomware attack and resume operations without much long-term damage.
Conclusion: Preparing Organizations for Triple Extortion Models
The operationalization of triple extortion ransomware is no longer an abstract threat; it is the reality of 2025. Attackers can now combine encryption, data leaks, and pressure from third parties to get the most leverage over organizations. Highly vulnerable organizations are exposed on all fronts.
Organizational readiness will require organizations to employ intention beyond perimeter defenses and improve their backup strategy. This includes business-wide proactive monitoring and detection, zero trust architectures, threat intelligence, and rehearsed recovery plans.
Ransomware actors are adapting; defenders must evolve faster.
