Proofpoint and LockBit: Greedy ransomware crews return for seconds after victims cough up first extortion payments

Ransomware Payments Fail to Guarantee Recovery, Proofpoint Data Reveals

A recent Proofpoint survey highlights the risks of paying ransomware demands, with data showing that compliance does not ensure resolution. Among UK organizations hit by ransomware, 58% paid the ransom yet 22% faced repeat extortion, a rate slightly better than the global average of 37%. Regional payment rates varied widely, from 19% in Japan to 93% in the US, influenced by regulatory environments, insurance incentives, and cultural attitudes toward negotiation.

The findings underscore a harsh reality: paying ransomware operators does not restore security. Even after payment, 2% of victims never recovered their files, while others encountered flawed decryptors such as a coding error in Nitrogen’s ESXi ransomware that left some data inaccessible. Law enforcement’s Operation Cronos, which dismantled the LockBit ransomware gang, confirmed long-held suspicions: attackers often retain stolen data even after receiving payment, undermining the assumption that compliance leads to resolution.

Beyond ransomware itself, AI is sharpening the attacks that enable it. In the UK, 65% of security practitioners reported that AI has intensified threats like malicious links, business email compromise, and credential harvesting. While AI has not yet become a core tool in ransomware payloads, it is enhancing phishing lures, impersonation attempts, and post-breach reconnaissance making initial access more effective. As Proofpoint’s Ryan Kalember noted, modern ransomware attacks increasingly exploit human trust and identity, rather than relying solely on technical vulnerabilities.

Source: https://www.theregister.com/security/2026/07/22/over-a-third-of-ransomware-victims-re-extorted-after-paying/5276218

CyberFortress cybersecurity rating report: https://www.rankiteo.com/company/cyberfortress

Proofpoint cybersecurity rating report: https://www.rankiteo.com/company/proofpoint

"id": "CYBPRO1784723165",
"linkid": "cyberfortress, proofpoint",
"type": "Ransomware",
"date": "1/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'location': 'UK', 'type': 'Organization'},
                       {'location': 'US', 'type': 'Organization'},
                       {'location': 'Japan', 'type': 'Organization'}],
 'attack_vector': ['Phishing',
                   'Business Email Compromise',
                   'Credential Harvesting'],
 'data_breach': {'data_encryption': True, 'data_exfiltration': True},
 'description': 'A recent Proofpoint survey highlights the risks of paying '
                'ransomware demands, with data showing that compliance does '
                'not ensure resolution. Among UK organizations hit by '
                'ransomware, 58% paid the ransom yet 22% faced repeat '
                'extortion. Regional payment rates varied widely, influenced '
                'by regulatory environments, insurance incentives, and '
                'cultural attitudes. Paying ransomware operators does not '
                'restore security, with 2% of victims never recovering their '
                'files and others encountering flawed decryptors. Law '
                'enforcement’s Operation Cronos confirmed attackers often '
                'retain stolen data even after payment. AI is also enhancing '
                'threats like phishing, business email compromise, and '
                'credential harvesting, making initial access more effective.',
 'impact': {'data_compromised': True, 'identity_theft_risk': True},
 'initial_access_broker': {'entry_point': ['Phishing',
                                           'Business Email Compromise',
                                           'Credential Harvesting']},
 'lessons_learned': 'Paying ransomware demands does not guarantee data '
                    'recovery or security restoration. Attackers may retain '
                    'stolen data even after payment, and flawed decryptors can '
                    'leave data inaccessible. AI is enhancing initial access '
                    'techniques like phishing and credential harvesting.',
 'motivation': ['Financial Gain', 'Data Exfiltration'],
 'post_incident_analysis': {'root_causes': ['Human trust exploitation',
                                            'AI-enhanced phishing and '
                                            'credential harvesting',
                                            'Flawed ransomware decryptors']},
 'ransomware': {'data_encryption': True,
                'data_exfiltration': True,
                'ransom_demanded': True,
                'ransom_paid': '58% (UK), 93% (US), 19% (Japan)',
                'ransomware_strain': ['LockBit', 'Nitrogen’s ESXi']},
 'recommendations': 'Avoid paying ransoms as it does not ensure recovery. '
                    'Strengthen defenses against phishing, business email '
                    'compromise, and credential harvesting. Enhance monitoring '
                    'for AI-driven threats and improve incident response '
                    'plans.',
 'references': [{'source': 'Proofpoint Survey'},
                {'source': 'Operation Cronos (LockBit dismantling)'}],
 'response': {'law_enforcement_notified': 'Operation Cronos (LockBit '
                                          'dismantling)'},
 'threat_actor': ['Ransomware Operators', 'Initial Access Brokers'],
 'title': 'Ransomware Payments Fail to Guarantee Recovery',
 'type': 'Ransomware'}