Ransomware in 2026: smaller gangs, faster attacks

The numbers

The large groups that made headlines two years ago have split into dozens of small teams. They rent the same tools, share the same playbooks and move fast, because they know defenders are watching.

• 47 minutes is the median time from the first click to the first encrypted file.

• 68% of attempts started with a mail, 21% with a stolen password, 11% with an unpatched server.

• 9 out of 10 attacks ran outside office hours, most between 1 and 5 a.m. local time.

How a 47 minute attack looks

A finance clerk opens an invoice that looks right. A small program starts quietly, finds saved passwords and tries them on the file server. Twenty minutes later it has admin rights. At minute 40 it turns off backups. At minute 47 it starts renaming files.

None of the steps were clever. Each one would have been stopped by a habit most teams already know they should have.

Hexwall saw the pattern at minute three, when the program touched saved passwords, and isolated the laptop before it reached the server.

Three habits that stop most of it

1. Multi factor login everywhere. It would have stopped every attack that started with a stolen password.

2. Backups the attacker cannot reach. Keep one copy offline or in a separate account with its own login.

3. Someone watching at night. If it is not a person, it should be software that can act on its own.

The full report, with numbers by industry and country size, is free for customers in the Reports screen of the dashboard.