Known. Is emerging Unbeatable? Rainmware attacks still avoid rescue

No, it is not new or especially foreigner, but after years of attacks, the ransomware continues to rank amidst the most devastating threats facing global outfits today.

Even security teams put important resources in prevention and explorers efforts, the attackers are still looking for ways to bypass their defense. Repeat recovery The default has become an approach, with group encrypting systems and stealing sensitive data for leverage.

Some are actors Now leave the encryption step completelyOnly to focus on data theft and forced recovery and to streamline their efforts.

Picus Securities Blue Report 2025 The curtain pulls back to show how easily cybercity defense is slipping.

Maximum drawing 160 million breech and attack simulation (BAS) resultsThis year’s Blue report Viewed overall prevention effectiveness fell from 69% in 2024 to 62% in 2025. However, the most dangerous discovery, however, was Data exfigning: Prevention fell to only 3%, already unacceptable down 9% Last year. It exposes outfits Absolutely on stage The ransomware groups exploit the most.

Tech uve is clear: The beliefs do not have equal protection, and when it matters the most, non-human rescue will fail.

Parshes the results, it becomes clear quickly that ransomware may not be considered readiness. It has to be proved. This means to continuously validate the rescue of your organization against long-known ransomware families as well as active strains active in the wild.

Breach and attack simulation provides the evidence that shows in real time whether security is erect or failed.

Why both known and emerging ransomware in cases

Unfortunately, with ransomware, all familiar often gives rise to false confidence. Security teams believe that they are protected against big -name strains, but over time, if left alone, their rescues are constantly weakening because configuration flows and atmosphere change.

The ransomware operator, meanwhile, keeps running. The code is re -designed, loaders are updated, and stolen techniques are refined to prevent the attacks from detecting the attacks. Unfortunately, the work done against yesterday’s campaign will not often work against today’s updated efforts.

This year’s Blue report It shows all clearly.

Out of the top 10 most underpravenant ransomware strains, Five new or emerging were emerging, yet they effectively sidelined the rescue as a long established names.,

• Known families are still successful, Blackbite (26%) The most difficult ransomware to prevent the second year in one line to exploit public-focused apps before encryption and exfiltrate data remains the most difficult ransomware. Bablock (34%) pressures the victims with forced recovery, while Maori (41%) takes advantage of fileless delivery and regional campaigns. Their strongness suggests how easily rescue can disappear in the actual environment.

• Emerging ransomware strains barely hitFaust (44%), Valak (44%), and Magniber (45%) controls through registration amendments, modular payloads and staging execution. About half of all attacks are successful, proving that new names quickly become effective in the wild.

• Established name adaptation. Blackkingdom (48%), black bag (49%), and play (50%) stolen credibility, process hollow and avoiding prevention with remote service execution. Even after years of documentation, it is difficult to stop them.

• Advanced ransomware operators remain flexible. Avoslocker achieved only 52% of the prevention rate, especially despite the targeted rescue exploited privilege increase and advanced obfuscation to compromise with important areas.

These findings describe an important point: The difference between “known” and “emerging” ransomware is becoming less and less meaningful, When organizations continuously fail to test their defense, both known and emerging strains can, and eventually, will remove their defense.

Biggest interval in defense

Rainmware groups rarely depend on the same trick. Instead, they add many techniques to the Kill chain and the weakest that takes advantage of rescue is the weakest.

Blue Report 2025 Shows that prevention and detection continuously inaugurate the attackers in the same way they are watching.

• Malware delivery: Prevention dropped 60% (Below 71% In 2024). Despite being one of the oldest attack vectors, loaders and droppers are still ignoring stable rescue.

• Detection pipeline: Only 14% Attacks generated an alert, even if 54% were loggedThis log-to-alert gap can easily leave defenders blind for both installed families such as Fast and Magniber.

• Data Exfility: Effectiveness in preventing data exfoliation only collapses 3% In 2025 (from below) 9% In 2024), the worst score of any attack vector. It increases weakness Repeat recovery The attacks, where the stolen data is leaked to increase the pressure on the victims.

• Closing point protection: Closing point blocked 76% In the attacks, but the lateral movement and the increase in the privilege have still worked in a quarter of cases. Families like Black Basta and Play exploited these weaknesses to spread within the compromised network.

Overall, the rescue continues not due to ransomware state -of -the -art techniques but at important points.

Five of the ten ransomware families highlighted in the report are long -established strains, yet they are new or as effectively protecting them Emerging threats, The attackers do not require the successes of the novel, only the ability to exploit what has already been broken.

How the bass ransomware strengthens readiness

Picus Violation and attack simulation (BAS) Helps stop the difference between organizations Thinking Can protect them and how they can In fact Perform against ransomware.

Unlike traditional penetration testing, which is periodic and manual, BAS provides continuous, automatic checks that show you that your rescue is against the behavior of real attacks, and where they do not, in your unique and dynamic environment.

The main base benefits include:

• Constant ransomware simulation. The base safely simulates and imitating the ransomware TTP seen in the wild, from the initial agreement through encryption and data theft, to show where your defense breaks, in circumference control and endpoint security.

• Verification against known and emerging families. Picus, both installed ransomware and intelligence on new variants daily update the bass threat libraries, which leads to the organizations tested against the same families seen in advice and who first appear in the wild.

• Actionable improvement. When the attacks are successful in simulation, the BAS provides practical therapeutic guidance, both seller-specific and seller-ignorant, so defenders know what to really have to adjust.

• Evidence of readiness. The BAS ransomware produces average data on flexibility, including the prevention rate, detection coverage and mitigation, gives tangible data to the security teams that they can show the leadership and auditors.

Shut down

One of the most dangerous beliefs in ransomware’s readiness is assuming that your rescue is working because they have worked to this point, or because you have deployed “right” products.

Blue Report 2025 Shows how misleading these two perceptions can be: About 50% The efforts of ransomware bypassed rescue, and only 14% Trigger alert.

BAS converts beliefs into evidence by answering questions that matter most:

• Will your DLP system really stop sensitive data from leaving your network?

• If the ransomware slips the previous endpoint control, will your seam increase the alarm in time?

• Are adequate tunes to block the fishing payload used by email gateway bubblocks or plays?

• Will new families such as Faust or Magniber go through anyone’s attention?

With BAS, security teams do not have to guess. They know.

conclusion

At the end, Blue Report 2025 One thing makes it clear: ransomware thrives because the attackers have strengthened the playbook, but because in behavior, rescue is rarely tested. The same security weaknesses resurves year -to -hand, sliding with prevention, detection leggings, and data theft almost completely uncontrolled.

Violation and attack simulation Is the missing piece. By securely simulating end-to-end ransomware attacks, including initial agreement, credential access, lateral movement, and data theft, bass pinpoints exactly where your defense and are not working and confirm what is being fixed. It changes readiness from the readiness to believe and prove it, gives the defenders something that they can measure every day, improve and display.

The readiness of the ransomware is beyond asking, “Are we preserved?”. This is about demonstrating the evidence of frequent flexibility, and BAS is the only permanent way to reach there.

Download Blue Report 2025 To get the complete picture, ranges from ransomware and data exfoliation to industry-by-industry performance, regional inequalities, matter ATT and CK strategy and technology gaps, and attackers of weaknesses are still exploited. See where the defense is slipping, and why is the constant verification ahead.

Sponsored and written by Picus security,