How modern ransomware attacks work and a breakdown of their double extortion tactics, using the Nefilim ransomware as a case study
Modern ransomware actors identify and target valuable data, often exfiltrating it from a victim's network organization rather than simply encrypting it.
Context & Ripple Effects
Trend Micro's Nefilim teardown is a case study in a playbook that had already surfaced by early 2020, when researchers reported rings stealing data before encrypting so that even victims with backups would pay. Microsoft's earlier write-up on REvil, Ryuk, and other manually operated strains showed these are hands-on-keyboard operations, not automated malware — which is what makes target selection and data identification possible at all.
The report lands between two other pieces of operator-side visibility: a researcher's trick that exposed ransom payout structures and cash-out schemes, and — later — evidence that gangs adopted intermittent encryption to evade detection tools. Together they map both the business model and the counter-detection arms race around it.
First-order effects
- Victims' backup-and-restore plans stop working as leverage-neutralizers: once Nefilim-style actors hold exfiltrated data, restoring systems does not prevent publication.
- Security teams monitoring only for intense file-encryption activity miss the more valuable signal — bulk outbound data transfer — because exfiltration happens quietly before encryption begins.
Second-order effects
- Detection vendors are pushed toward egress and staging-behavior analytics rather than file-I/O heuristics, a race the gangs answered with partial-encryption techniques that keep I/O patterns under threshold.
- Victim negotiation dynamics shift: with payout structures and cash-out schemes publicly mapped by researchers, leaked-data threats become the primary pressure point, and breach-notification/leak-site exposure becomes part of the attacker's toolkit.
Third-order effects
- Ransomware structurally converges with data-breach economics — the product is no longer encrypted files but stolen data plus disruption, which pulls in regulators and disclosure obligations alongside incident response.
- If the pattern holds, the market splits into human-operated big-game hunting of high-value data targets versus commodity automated strains, raising the cost floor for enterprises that hold sensitive records.
The trend: Ransomware is completing its shift from an encryption-extortion model to a double-extortion business built on data theft, with each defensive advance met by a new evasion technique.