FROM ACCESS TO EXFILTRATION: WHAT DEFENDERS NEED TO KNOW

**The Exfiltration Epidemic: How Ransomware Operators Are Hijacking Your Data**

Ransomware has long been a major concern for cybersecurity professionals, but a recent report from ThreatLabz sheds new light on a disturbing trend: the scale of data exfiltration by top ransomware groups has surged by 275.8% year over year, reaching an alarming 896.2 terabytes. This massive increase in data theft is not just a statistical anomaly – it's a symptom of a more insidious threat.

**The Anatomy of a Ransomware Attack**

To understand the scope of the problem, let's take a closer look at the typical ransomware attack chain. The process begins with initial access, where attackers use spam bombing, phishing, or other social engineering tactics to gain a foothold in the network. This is often facilitated by targeted people, such as manager-level employees who have broad access to sensitive data. Once inside, attackers move laterally, using tools like Microsoft Quick Assist, AnyDesk, or TeamViewer to establish a secure channel for data exfiltration.

**The Role of AI in Ransomware**

The rise of generative AI is also having a profound impact on ransomware attacks. Attackers can use AI to personalize lures, generate functional malware code, and even identify high-value employees faster. For instance, ThreatLabz observed likely AI-assisted tooling in a campaign by Payouts King, a group that emerged in mid-2025 with tradecraft tied to former Black Basta affiliates.

**The Window of Opportunity**

The time between initial access and meaningful data loss may be measured in hours, not days or weeks. This compressed timeline calls for a different way of thinking about risk. Time-to-exfiltration should be a key risk indicator for security teams, not just an incident debrief metric. Controls that focus primarily on detecting or recovering from encryption (traditional antivirus, backup and restore procedures) don't reduce exfiltration impact. The leverage is already in the attacker's hands.

**Closing the Window: Controls that Match the Timeline**

To reduce ransomware risk at the speed these attacks move, controls positioned across the kill chain are essential. Shrink the attack surface by hiding private applications from the public internet entirely, using zero trust network access. Use breach prediction technology to simulate likely attack paths before an incident occurs, giving security teams the ability to remediate proactively. Data loss prevention enforces inline controls across web, cloud, and email traffic, blocking unauthorized uploads to personal cloud storage, web file-sharing services, and unsanctioned SaaS destinations.

**Measuring Time-to-Exfiltration**

While the 275.8% surge in exfiltration volume is alarming, the report also shows that terabyte-scale theft requires time, access, and movement, a chain of attacker activity that defenders can disrupt at multiple points. The organizations that fare best aren't necessarily the ones with the fastest incident response. They're the ones that made the attacker's job harder at every stage: harder to get in, harder to move laterally, harder to reach in and remove valuable data.

**Conclusion**

The exfiltration epidemic is real, and it's growing by the terabyte. Ransomware operators are hijacking your data, and it's up to defenders to close the window of opportunity. By treating time-to-exfiltration as a risk metric, monitoring for it, and building controls that operate well before encryption is ever on the table, we can reduce the impact of these devastating attacks. The time to act is now.

**Download the ThreatLabz 2026 Ransomware Report**

For a full analysis of the top ransomware groups, victimology data, payment trends, and technical case studies, download the ThreatLabz 2026 Ransomware Report. This report provides a comprehensive look at the ransomware landscape, including the tactics, techniques, and procedures (TTPs) used by top ransomware groups.

**Disclaimer**

This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices.