TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

ESET WeLiveSecurity

Naming and shaming: How ransomware groups tighten the screws on victims

2026-02-12 · Read original ↗

ATT&CK techniques detected

12 predictions
T1486Data Encrypted for Impact
100%
"the next attack. for organizations, the ransomware threat demands comprehensive defensive measures, which include : - deploying advanced security solutions with edr / xdr / mdr capabilities. among other things, they monitor anomalous behavior, such as unauthorized process executi…"
T1486Data Encrypted for Impact
96%
"naming and shaming : how ransomware groups tighten the screws on victims in the realm of cybercrime, change is arguably the only constant. while cyber - extortion as a broader category of crime has proved its staying power, ransomware – its arguably most damaging ‘ flavor ’ – doe…"
T1657Financial Theft
88%
"extortion ” problem. public tracking projects such as ransomware. live point in the same direction, even if precise victim counts should be treated with caution. the leak sites reflect only what criminals choose to ‘ advertise ’, not the full universe of incidents. let ’ s examin…"
T1486Data Encrypted for Impact
85%
"wave of attackers as attackers advertise ‘ affiliate programs ’, explaining the revenue split and how to apply. zooming out data leak sites work because they hit companies ’ weak spots that go beyond technology. a potential data leak triggers multiple risks at once : reputational…"
T1486Data Encrypted for Impact
82%
"victims pay ransoms, flawed decryption processes can result in permanent data loss, not to mention other possible ramifications of paying the ransom. resilient backups and ransomware remediation capabilities go a long way towards mitigating damage from the threat. - human vigilan…"
T1486Data Encrypted for Impact
79%
"extortion ” problem. public tracking projects such as ransomware. live point in the same direction, even if precise victim counts should be treated with caution. the leak sites reflect only what criminals choose to ‘ advertise ’, not the full universe of incidents. let ’ s examin…"
T1657Financial Theft
67%
"naming and shaming : how ransomware groups tighten the screws on victims in the realm of cybercrime, change is arguably the only constant. while cyber - extortion as a broader category of crime has proved its staying power, ransomware – its arguably most damaging ‘ flavor ’ – doe…"
T1657Financial Theft
61%
"wave of attackers as attackers advertise ‘ affiliate programs ’, explaining the revenue split and how to apply. zooming out data leak sites work because they hit companies ’ weak spots that go beyond technology. a potential data leak triggers multiple risks at once : reputational…"
T1490Inhibit System Recovery
58%
"victims pay ransoms, flawed decryption processes can result in permanent data loss, not to mention other possible ramifications of paying the ransom. resilient backups and ransomware remediation capabilities go a long way towards mitigating damage from the threat. - human vigilan…"
T1003OS Credential Dumping
53%
"the next attack. for organizations, the ransomware threat demands comprehensive defensive measures, which include : - deploying advanced security solutions with edr / xdr / mdr capabilities. among other things, they monitor anomalous behavior, such as unauthorized process executi…"
T1657Financial Theft
37%
"was real and the threat is credible. - urgency : timers and countdowns instill the feeling that time is running out as decisions made under time pressure are more likely to favor the party that controls the clock. - public exposure : even if the stolen data is never released publ…"
T1490Inhibit System Recovery
35%
"naming and shaming : how ransomware groups tighten the screws on victims in the realm of cybercrime, change is arguably the only constant. while cyber - extortion as a broader category of crime has proved its staying power, ransomware – its arguably most damaging ‘ flavor ’ – doe…"

Summary

When corporate data is exposed on a dedicated leak site, the consequences linger long after the attack fades from the news cycle