Threat Intel
The 2026 ransomware playbook: what changed and how to respond
Double extortion is now the baseline. Here is how modern crews gain access, how long they dwell, and the five controls that stop most of them.
SAMO Threat Research · · 8 min read
Ransomware has matured into an industry. Initial access brokers, affiliate programmes and negotiation desks now operate with the discipline of a SaaS business, and the playbooks they follow are increasingly predictable. That predictability is an opportunity for defenders.
How attackers get in
Across the incidents our responders handled over the last twelve months, three entry points dominate:
- Valid credentials for VPN or remote access without phishing-resistant MFA
- Unpatched edge devices: firewalls, file-transfer appliances and VPN concentrators
- Help-desk social engineering to reset MFA on privileged accounts
The five controls that matter most
- Phishing-resistant MFA (FIDO2) on every externally reachable login
- A 72-hour patch SLA for internet-facing appliances
- Immutable, offline-tested backups with a documented restore time
- EDR on 100% of servers, with tamper protection enforced
- 24/7 monitoring that can isolate a host without waiting for approval
The best-defended organisations are not the ones with the most tools. They are the ones that can act within minutes of the first signal.
What to do this quarter
Run a tabletop exercise built on a realistic double-extortion scenario, measure how long a restore actually takes, and verify that your monitoring partner has pre-approved authority to contain. Those three steps close most of the gap between an incident and a crisis.