Topic starter
12/07/2026 12:21 pm
TL;DR: Ransomware payments fell about 8% to $820 million in 2025 even as claimed attacks rose 50%, median payments jumped 368% to nearly $60,000, and initial access broker inflows often preceded payment and leak-site spikes by roughly 30 days, according to Chainalysis. The market is shifting from isolated extortion events to an access-and-infrastructure economy where disruption, not just response speed, determines defender outcomes.
Editorial analysis by NHI Mgmt Group, based on content published by Chainalysis: “Total Ransomware Payments Stagnate for Second Consecutive Year, While Attacks Escalate”.
By the numbers:
- Total on-chain ransomware payments fell by approximately 8% to $820 million in 2025.
- The median ransom payment increased 368% year-over-year to nearly $60,000 in 2025.
- Claimed ransomware attacks rose 50% year-over-year in 2025.
Key questions
A: Ransomware becomes cheaper to scale because attackers can buy access instead of earning it.
Q: Why do access-market spikes matter before ransomware payments rise?
A: Because access brokerage is often the upstream signal that later extortion is being prepared.
Q: What are the signs that ransomware infrastructure is being reused across different actors?
A: Look for shared hosting providers, common proxy networks, repeated malware loading infrastructure, and financial flows that cross actor boundaries.
Practitioner guidance
- Harden exposed access paths first Prioritise remote access services, VPNs, identity providers, and externally reachable admin interfaces that could be monetised by access brokers.
- Treat broker signals as pre-incident intelligence Feed access-market, leaked credential, and unusual authentication telemetry into threat hunting so suspected broker activity can be investigated before encryption or leak-site pressure begins.
- Shrink standing privilege across NHI estates Inventory service accounts, tokens, API keys, and delegated machine access, then remove privileges that are not required for current operations.
Bottom line: Ransomware in 2025 behaved less like isolated extortion and more like a service economy built on access brokerage and shared infrastructure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:34 pm
Ransomware is now an access economy, not just an extortion economy. The article shows that the real market is not only the ransom payment but the resale of access, the rental of infrastructure, and the movement of victim credentials through a broader criminal supply chain. That makes identity governance part of ransomware prevention, not merely an adjacent concern. Practitioners should treat access brokerage as an upstream business model that converts unmanaged trust into monetisable compromise.
A question worth separating out:
A: They should widen response from one adversary to the service layer that sustains many adversaries. That means blocking abused hosting, tracking proxy and loader dependencies, and tightening identity and access controls so the organisation is harder to monetise even when infrastructure persists elsewhere.
👉 Read our full editorial: Ransomware payments flattened as access markets and infrastructure grew