Topic starter
12/07/2026 12:21 pm
TL;DR: 2025 ransomware payments on-chain fell about 8% to $820 million even as reported victims rose 50%, median payments jumped 368% to $59,556, and initial access broker activity appears to precede later extortion by roughly 30 days, according to Chainalysis. The economics now reward access, infrastructure, and timing more than volume alone, making identity and credential governance a front-line control.
Editorial analysis by NHI Mgmt Group, based on content published by Chainalysis: “ランサムウェアの身代金総額が2年連続で停滞、攻撃件数は急増”.
Key questions
Q: What breaks when ransomware actors buy access instead of stealing it themselves?
A: When attackers buy footholds, traditional perimeter indicators arrive too late because the initial compromise has already been converted into authenticated access.
Q: Why do standing privileges make ransomware incidents harder to contain?
A: Standing privileges give an attacker more authority after the first login, which shortens the time needed to move from access to disruption.
Q: What are the signs that an email-based ransomware campaign is moving beyond initial access?
A: A campaign is likely moving beyond initial access when operators begin reconnaissance, privilege escalation, and lateral movement after the first payload lands.
Practitioner guidance
- Map brokerable access paths Identify which external-facing services, privileged accounts and third-party connections could be turned into saleable access if compromised.
- Shorten the lifetime of exposed access Reduce how long credentials, sessions and delegated permissions remain useful by enforcing rapid expiry, offboarding and revocation for accounts that can be resold or reused.
- Review third-party and brokerable identities Audit vendors, contractors and service relationships for accounts that can be abused as initial access inventory, especially where authentication is weak or access is hard to attribute.
Bottom line: Ransomware has become a market structure in which access, infrastructure and extortion are economically linked.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:34 pm
Access brokerage is now a governance problem, not just an intrusion problem. When ransomware markets pay for footholds before they pay for encryption, identity and access teams inherit part of the threat surface. That shifts the defensive unit from the incident to the access lifecycle, where inventory, ownership, expiry and revocation determine whether a foothold becomes monetisable.
A question worth separating out:
A: Organisations should shift immediately into disciplined incident response: isolate affected systems, preserve evidence, verify the scope of encryption, and communicate clearly and regularly to customers, employees, and regulators. Delayed or vague updates deepen trust loss and can worsen operational disruption. A prepared response plan should define escalation paths, approval rights, external communications, and recovery priorities before an incident begins.
👉 Read our full editorial: Ransomware is shifting toward access markets and infrastructure