Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands
Proofpoint AI Era Ransomware Report (TL-2026-1710), also tracked as 2026 AI-Era Ransomware Report, is a medium-severity ransomware operation, first published 2026-07-22 and last reviewed 2026-07-27. It is attributed to Nitrogen (Russia) with high confidence, affects Citrix NetScaler ADC / NetScaler Gateway, references 6 CVEs (CVE-2023-4966, CVE-2023-4967, CVE-2023-0669), maps to 66 MITRE ATT&CK techniques (T1003, T1003.001, T1005), and is covered by 9 detection rules and 54 indicators of compromise.
Key facts for TL-2026-1710
- Threat ID
- TL-2026-1710
- Also known as
- 2026 AI-Era Ransomware Report, Repeat/Double Extortion Wave, Second Ransom Demand Phenomenon, NitroBlog Leaks
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-07-22
- Last reviewed
- 2026-07-27
- Attribution
- Nitrogen
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government administration, finance, health, manufacturing, technology, construction, electronics, aerospace, critical-infrastructure, education, retail, professional-services
- Target regions
- North America, united states of america, united kingdom, Europe, japan, Asia-Pacific, australia, Middle East, UAE, india, brazil, Global
- Detection rules
- 9
- Indicators of compromise
- 54
- Updates
- 2026-07-27 · revalidated 1× · latest source
Malware and tooling in Proofpoint AI Era Ransomware Report
Malware and tooling: BlackCat/ALPHV, LockBit 3.0 - S1202, nitrogen, BloodHound/SharpHound, Cobalt Strike, Impacket - S0357, PowerView, Sliver - S0633
Proofpoint's 2026 AI-Era Ransomware Report (953 security professionals, 12 countries) finds 54% of ransomware-affected organizations globally paid an initial ransom, and 37% of those payers were subsequently hit with a second extortion demand — evidence that ransomware crews increasingly retain stolen data and revisit prior payers rather than treating payment as a one-time transaction. LockBit (dismantled by Operation Cronos, retained victim data post-payment) and the Nitrogen ESXi ransomware gang (whose own encryption bug makes paid decryption impossible) are cited as concrete examples of the trend.
How Proofpoint AI Era Ransomware Report works
Proofpoint's 2026 AI-Era Ransomware Report surveyed 953 cybersecurity professionals across 12 countries (US, UK, France, Germany, Italy, Spain, UAE, Australia, Japan, Singapore, India, Brazil) and 20 industry sectors between March and April 2026. The headline finding is that ransomware has evolved from a single encryption event into a sustained, multi-stage extortion campaign: 65% of affected organizations said AI had measurably improved the attacks that precede ransomware deployment (more convincing phishing, BEC, credential harvesting, and malicious-link lures), and 66% of victims had sensitive data stolen before or alongside encryption. Globally, 54% of affected organizations paid a ransom, yet 37% of those payers were hit with a second extortion demand — meaning payment increasingly buys temporary relief rather than closure. Regional variation was stark: 58% of UK organizations paid (of whom 22% faced repeat extortion), 93% of US organizations paid, and only 19% of Japanese organizations paid, a spread Proofpoint attributes to differing regulatory environments, recovery capability, insurance incentive structures, and cultural norms around disclosure and negotiation. Two percent of all payers never recovered their encrypted files regardless of payment.
The report and its press coverage (DataBreaches.net, The Register) ground the repeat-extortion trend in two concrete, named-actor case studies. LockBit, the prolific Russia-linked ransomware-as-a-service (RaaS) operation administered by Dmitry Yuryevich Khoroshev (alias 'LockBitSupp'), claimed over 2,000 victims and more than $120M in ransom payments before international law enforcement's Operation Cronos seized 34 servers across eight countries on 19 February 2024, recovered roughly 1,000 decryption keys, froze 200+ cryptocurrency accounts, and arrested affiliates in Poland and Ukraine. Critically, investigators discovered that LockBit had not deleted victims' exfiltrated data as promised after ransom payment — the exact repeat-extortion risk Proofpoint's survey quantifies. Khoroshev was subsequently indicted on 26 counts in US federal court and sanctioned by the US, UK, and Australia, with a $10M US State Department reward for his arrest.
The second case study, Nitrogen, is a ransomware operation that emerged in 2023 as an initial-access loader for the BlackCat/ALPHV RaaS operation before evolving into an independent double-extortion ransomware group by late 2024, using code derived from the leaked Conti 2 builder and tradecraft overlapping with former BlackCat affiliates. Nitrogen's primary initial-access technique is malvertising: fraudulent, highly-ranked Google ads distribute trojanized installers of legitimate admin tools (WinSCP, AnyDesk, Advanced IP Scanner, PuTTY), delivered inside archives (e.g., 'Version.zip') containing a masqueraded, DLL-side-loaded Python interpreter. A documented September 2024 intrusion (analyzed in depth by The DFIR Report) shows the full kill chain: drive-by malvertising compromise, Sliver and Cobalt Strike beacon deployment via Py-Fuscate-obfuscated Python loaders, LSASS credential dumping (first local-admin, then domain-admin credentials within hours), BloodHound/PowerView/Impacket-driven AD discovery and lateral movement over RDP and SMB admin shares, Restic-based exfiltration to a Bulgaria-hosted REST server, and — roughly 156 hours after initial access — deployment of BlackCat/ALPHV ransomware via PsExec, preceded by Safe Mode boot reconfiguration, Volume Shadow Copy deletion, and mass Windows event-log clearing. In February 2026, researchers at Coveware disclosed that Nitrogen's own ESXi ransomware variant contains a memory-offset coding error that corrupts the RSA/Curve25519 public key during encryption, meaning even Nitrogen's own decryptor cannot recover encrypted ESXi hosts — converting a financially-motivated attack into irreversible destruction regardless of whether the ransom is paid. In May 2026, Nitrogen listed electronics manufacturer Foxconn on its 'NitroBlog' leak site, claiming roughly 8TB (11M+ files) of exfiltrated data including project documentation tied to Intel, Apple, Google, Dell, and Nvidia; Foxconn confirmed a cyberattack against its North American operations the following day.
Collectively, these case studies validate Proofpoint's core recommendation: because modern ransomware operators (a) do not reliably delete stolen data after payment and (b) increasingly launch follow-on extortion demands against prior payers, defenders should treat ransomware primarily as an identity, email, and trusted-communication problem rather than a purely endpoint/recovery problem, and should adopt payment policies that assume repeat extortion as the likely, not exceptional, outcome.
MITRE ATT&CK techniques used in TL-2026-1710
Credential Access
T1003 OS Credential Dumping; T1003.001 LSASS Memory; T1539 Steal Web Session Cookie
Collection
T1005 Data from Local System; T1039 Data from Network Shared Drive
Discovery
T1018 Remote System Discovery; T1057 Process Discovery; T1069.001 Local Groups; T1069.002 Domain Groups; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.001 Local Account; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1614 System Location Discovery; T1680 Local Storage Discovery
Lateral Movement
T1021 Remote Services; T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1574.001 DLL; T1622 Debugger Evasion
Exfiltration
T1030 Data Transfer Size Limits; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.006 Python; T1106 Native API; T1204.002 Malicious File; T1569 System Services; T1569.002 Service Execution
Persistence
T1053 Scheduled Task/Job; T1053.005 Scheduled Task; T1098 Account Manipulation; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution; T1547.004 Winlogon Helper DLL
Privilege Escalation
T1055.001 Dynamic-link Library Injection; T1548 Abuse Elevation Control Mechanism
Command and Control
T1071 Application Layer Protocol; T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing
defense-impairment
T1484 Domain or Tenant Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1688 Safe Mode Boot
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Affected products and versions in Proofpoint AI Era Ransomware Report
- Citrix — NetScaler ADC / NetScaler Gateway
Vulnerable versions: builds affected by CVE-2023-4966 Citrix Bleed
Fixed in: patched builds per Citrix security bulletin - Fortra — GoAnywhere MFT
Vulnerable versions: versions affected by CVE-2023-0669
Fixed in: patched releases per Fortra advisory - PaperCut — PaperCut MF/NG
Vulnerable versions: versions affected by CVE-2023-27350
Fixed in: patched releases - Fortinet — FortiOS SSL VPN
Vulnerable versions: versions affected by CVE-2018-13379
Fixed in: patched FortiOS releases - Microsoft — Windows SMBv3
Vulnerable versions: versions affected by CVE-2020-0796 (SMBGhost)
Fixed in: patched Windows builds - Broadcom/VMware — ESXi hypervisor
Vulnerable versions: ESXi hosts targeted by Nitrogen's ransomware encryption routine, which contains a memory-offset coding defect corrupting the public key so no valid decryption key exists
Fixed in: N/A — malware-side coding defect, not a vendor vulnerability - Foxconn — North American manufacturing operations (named victim)
Vulnerable versions: N/A
Fixed in: N/A
Remediation for Proofpoint AI Era Ransomware Report
Patches
- Patch Citrix NetScaler ADC/Gateway against CVE-2023-4966 / CVE-2023-4967 (Citrix Bleed)
- Patch Fortra GoAnywhere MFT against CVE-2023-0669
- Patch PaperCut MF/NG against CVE-2023-27350
- Patch Fortinet FortiOS SSL VPN against CVE-2018-13379
- Patch Windows SMBv3 against CVE-2020-0796 (SMBGhost)
Immediate actions
- Treat attacker promises to delete stolen data as unverifiable; assume exfiltrated data remains at risk of resale or re-extortion even after a ransom is paid
- Engage law enforcement (FBI/IC3, UK NCA, Europol) and a qualified ransomware negotiation/incident-response firm before making any payment decision
- Rebuild affected ESXi hosts and servers from offline/immutable backups rather than relying on attacker-supplied decryptors, which may be non-functional (as with Nitrogen's ESXi encryption bug)
- Force domain-wide credential rotation and disable/reset any accounts touched following confirmed LSASS dumping or domain-admin compromise
Workarounds
- Enforce application allow-listing for administrative tools frequently trojanized in malvertising campaigns (WinSCP, AnyDesk, Advanced IP Scanner, PuTTY)
- Block outbound traffic to known Sliver/Cobalt Strike C2 infrastructure and alert on Restic REST-protocol exfiltration patterns
- Restrict and alert on unauthorized Safe Mode with Networking boot reconfiguration, a documented precursor to Nitrogen/BlackCat ransomware deployment
Longer-term hardening
- Prioritize identity-, email-, and trusted-communication-centric defenses (anti-phishing, BEC detection, credential-harvesting monitoring) ahead of endpoint-only ransomware controls, per Proofpoint's AI-era findings
- Deploy immutable, offline, and regularly tested backups with restoration drills to remove attacker leverage in double- and repeat-extortion scenarios
- Implement network segmentation and monitoring for RDP, SMB admin-share, PowerView/BloodHound, and Impacket-style lateral-movement activity
- Adopt a documented ransom-payment policy that treats payment as risk transfer rather than resolution, given the observed 37% global repeat-extortion rate among payers
CVEs associated with Proofpoint AI Era Ransomware Report
CVE-2023-4966, CVE-2023-4967, CVE-2023-0669, CVE-2023-27350, CVE-2018-13379, CVE-2020-0796
Weaknesses (CWE) in Proofpoint AI Era Ransomware Report
CWE-125, CWE-502, CWE-284, CWE-22, CWE-787
Timeline of Proofpoint AI Era Ransomware Report
Showing the 20 most recent tracked events.
- LockBit ransomware-as-a-service operation begins, per US DOJ indictment of administrator Dmitry Khoroshev ('LockBitSupp')
- LockBit's affiliate (ransomware-as-a-service) program formally launches under the LockBitSupp persona.
- LockBit 3.0 ("LockBit Black") first observed in the wild, later the primary target of CISA advisories AA23-075A and AA23-165A.
- CISA, FBI, and MS-ISAC publish joint #StopRansomware advisory AA23-075A on LockBit 3.0 TTPs and IOCs.
- CISA publishes AA23-165A, mapping over 40 LockBit TTPs to the MITRE ATT&CK framework
- CISA publishes AA23-325A warning that LockBit 3.0 affiliates are actively exploiting Citrix Bleed (CVE-2023-4966), used in the Boeing breach
- LockBitSupp is banned from the Russian-language cybercrime forums XSS and Exploit, later cited by NCA as evidence of leadership failure to protect affiliates.
- Operation Cronos (10-country law enforcement task force) seizes 34 LockBit servers, ~1,000 decryption keys, freezes 200+ crypto accounts, and arrests affiliates in Poland and Ukraine; investigators find LockBit had not deleted exfiltrated victim data as promised
- NCA, FBI, and Europol publicly announce Operation Cronos: 14,000+ rogue accounts closed, indictments unsealed against affiliates Artur Sungatov and Ivan Kondratyev (Bassterlord), admin-panel screenshots and affiliate data published as part of a deliberate trust-erosion campaign, alongside a countdown-timer threat to unmask LockBitSupp.
- LockBit resurfaces with a new leak site listing victims within days of the takedown and teases a forthcoming LockBit 4.0 encryptor.
- US, UK, and Australia unmask, indict (26 counts), and sanction LockBit administrator Dmitry Yuryevich Khoroshev; US offers $10M reward for his arrest
- The DFIR Report publishes a full intrusion analysis of a Nitrogen campaign using malvertising, Sliver/Cobalt Strike, and Restic exfiltration to deploy BlackCat/ALPHV ransomware roughly 156 hours after initial access
- LockBit 5.0 ("ChuongDong") deployed for the group's sixth anniversary, adding cross-platform Windows/Linux/ESXi support and ETW-tampering anti-analysis.
- Multiple cybersecurity advisories confirm active in-the-wild deployment of LockBit 5.0 against enterprise targets.
- Barracuda Networks publishes analysis of Nitrogen's evolution from a BlackCat/ALPHV initial-access loader (2023) into an independent double-extortion ransomware operator
- Coveware/The Register report that Nitrogen's ESXi ransomware contains a memory-offset coding error that corrupts the public key, making decryption impossible even for the attackers themselves
- Nitrogen lists Foxconn on its 'NitroBlog' leak site, claiming theft of ~8TB / 11M+ files including Intel, Apple, Google, Dell, and Nvidia project documentation
- Foxconn confirms a cyberattack against its North American manufacturing operations
- DataBreaches.net and The Register publish coverage of the Proofpoint report's repeat-extortion findings, citing LockBit and Nitrogen as concrete examples
- Proofpoint publishes its 2026 AI-Era Ransomware Report (953 respondents, 12 countries), finding 54% of victims paid a ransom globally and 37% of payers faced a second extortion demand
Update history for TL-2026-1710
- 2026-07-27 — Operation Cronos Retrospective: How the FBI/NCA-Led LockBit Takedown Targeted Affiliate Trust, Not Just Infrastructure: What changed Attribution confidence MEDIUM - HIGH on the strength of DOJ-indictment-grade OSINT attribution (reused email addresses, forum personas putinkrab/NeroWolfe, personal VKontakte account) tying LockBitSupp to Dmitry Khoroshev. No s
Sources cited for Proofpoint AI Era Ransomware Report
- Greedy ransomware crews return for seconds after victims cough up first extortion payments
- Over a third of ransomware victims re-extorted after paying
- 2026 AI-Era Ransomware Report
- Proofpoint Research Finds 65% of Organisations Affected by Ransomware Say AI Made Attacks More Effective
- Understanding Ransomware Threat Actors: LockBit (AA23-165A)
- #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE-2023-4966 Citrix Bleed Vulnerability (AA23-325A)
- #StopRansomware: LockBit 3.0 (AA23-075A)
- Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware
- Nitrogen can't unlock its own ransomware after coding error
- Foxconn confirms cyberattack after ransomware crew claims it stole confidential Apple, Nvidia files
- Nitrogen Ransomware on a Manufacturer Attack Spree
- Nitrogen ransomware: From staged loader to full-scale extortion
- US and UK Authorities Identify, Sanction and Unseal Indictment Against Leader of LockBit Ransomware Group
Threats related to Proofpoint AI Era Ransomware Report
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
- Foxconn North American Factories Cyberattack — Nitrogen Ransomware Claims 8 TB / 11M+ Documents Stolen, Including Network Topologies for AMD/Intel/Google
- Human-Operated Ransomware via GPO Abuse — Domain-Wide Encryption Through Group Policy Weaponization
- Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi
- The Gentlemen Ransomware: Worm-Like Self-Propagation and Network-Wide Encryption via Storm-2697's RaaS Affiliate Program
- France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge
Detection coverage for TL-2026-1710
As of 2026-07-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1710 across Splunk SPL, Microsoft KQL and Sigma, covering 54 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.