Topic starter
11/11/2026 6:00 pm
TL;DR: Attackers are no longer relying on encryption alone in ransomware incidents, according to Barracuda. Backup sabotage, privilege elevation and lateral movement make restoration and containment much harder for defenders.
Editorial analysis by NHI Mgmt Group, based on content published by Barracuda: “The Ransomware Insights Report 2025”.
By the numbers:
- 57% of organisations experienced a successful ransomware attack in the last 12 months.
- 32% paid a ransom, but less than half, 41%, got all their data back.
- 71% of organisations that had experienced an email breach were also hit with ransomware.
Key questions
Q: Why do malicious emails so often lead to ransomware or data theft?
A: Phishing works because the email is only the entry point.
Q: How do ransomware attackers block data recovery?
A: Ransomware attackers block data recovery by deleting backups, encrypting shared storage, corrupting recovery points, and removing Volume Shadow Copies, which are local restore snapshots in Windows.
Q: What should teams do immediately after discovering ransomware access?
A: Contain the identity path before focusing on payload cleanup.
Practitioner guidance
- Tighten privileged access around recovery systems Separate backup administration from production administration, restrict who can delete snapshots or modify restore points, and review all accounts that can change recovery infrastructure.
- Hunt for pre-ransomware identity signals Correlate mailbox anomalies, impossible travel, suspicious forwarding rules, unusual admin logins and lateral movement patterns so email compromise is treated as an intrusion precursor.
- Test restore paths from a compromised account Run controlled recovery exercises that assume an attacker has one privileged production identity, then verify whether backups, shadow copies and recovery credentials still remain protected.
Bottom line: Ransomware now creates operational risk through recovery disruption as much as through encryption itself.
Glossary terms: Ransomware, Lateral Movement, Privilege Escalation, Shadow Copies
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Ransomware has become a recovery-denial campaign, not just an encryption event. The survey shows attackers layering backup wiping, shadow copy deletion and persistence onto the familiar encryption playbook. That changes the control objective from merely containing malware to preserving a recoverable state after compromise. Practitioners should measure whether a ransomware incident can still be rolled back without relying on attacker goodwill.
A few things that frame the scale:
- Half of 1,100 global security leaders surveyed by CrowdStrike believed they were very well prepared for ransomware, yet 78% of their organisations had been attacked in the past year.
A question worth separating out:
Q: What is the best way to limit ransomware spread across a network?
A: The best way to limit ransomware spread across a network is to remove standing privilege, segment systems, and restrict lateral movement with least privilege, JIT access, and strong admin separation. Attackers spread fastest when service accounts, remote management tools, and shared local administrator passwords can reach many endpoints without containment.
👉 Read our full editorial: Ransomware now pairs encryption with backup sabotage and persistence