New ransomware tactics to watch out for in 2026
Summary
Ransomware groups are evolving their tactics due to decreased profitability in 2025, despite an increase in attacks. New tactics include offering bundled DDoS services, recruiting insiders, and exploiting gig workers. Defenders need to prepare for these emerging trends in 2026.
IFF Assessment
The evolution of ransomware tactics presents a challenge for defenders as attackers adapt to improve their success rates.
Severity
Defender Context
Defenders need to proactively monitor for signs of insider compromise, increased DDoS activity combined with ransomware demands, and potential vulnerabilities in gig worker onboarding and management processes. The trend of ransomware groups diversifying their attack vectors and business models requires a layered defense approach incorporating threat intelligence, behavioral analysis, and robust access controls.