# Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands

> Proofpoint's 2026 AI-Era Ransomware Report (953 security professionals, 12 countries) finds 54% of ransomware-affected organizations globally paid an initial ransom, and 37% of those payers were subsequently hit with a second extortion demand — evidence that ransomware crews increasingly retain stolen data and revisit prior payers rather than treating payment as a one-time transaction. LockBit (dismantled by Operation Cronos, retained victim data post-payment) and the Nitrogen ESXi ransomware gang (whose own encryption bug makes paid decryption impossible) are cited as concrete examples of the trend.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-27T21:49:07.857Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1710
- **ID:** TL-2026-1710
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Nitrogen (Russia)
- **Detections:** 9 · **IOCs:** 54 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-4966, CVE-2023-4967, CVE-2023-0669, CVE-2023-27350, CVE-2018-13379, CVE-2020-0796

## Description

Proofpoint's 2026 AI-Era Ransomware Report surveyed 953 cybersecurity professionals across 12 countries (US, UK, France, Germany, Italy, Spain, UAE, Australia, Japan, Singapore, India, Brazil) and 20 industry sectors between March and April 2026. The headline finding is that ransomware has evolved from a single encryption event into a sustained, multi-stage extortion campaign: 65% of affected organizations said AI had measurably improved the attacks that precede ransomware deployment (more convincing phishing, BEC, credential harvesting, and malicious-link lures), and 66% of victims had sensitive data stolen before or alongside encryption. Globally, 54% of affected organizations paid a ransom, yet 37% of those payers were hit with a second extortion demand — meaning payment increasingly buys temporary relief rather than closure. Regional variation was stark: 58% of UK organizations paid (of whom 22% faced repeat extortion), 93% of US organizations paid, and only 19% of Japanese organizations paid, a spread Proofpoint attributes to differing regulatory environments, recovery capability, insurance incentive structures, and cultural norms around disclosure and negotiation. Two percent of all payers never recovered their encrypted files regardless of payment.

The report and its press coverage (DataBreaches.net, The Register) ground the repeat-extortion trend in two concrete, named-actor case studies. LockBit, the prolific Russia-linked ransomware-as-a-service (RaaS) operation administered by Dmitry Yuryevich Khoroshev (alias 'LockBitSupp'), claimed over 2,000 victims and more than $120M in ransom payments before international law enforcement's Operation Cronos seized 34 servers across eight countries on 19 February 2024, recovered roughly 1,000 decryption keys, froze 200+ cryptocurrency accounts, and arrested affiliates in Poland and Ukraine. Critically, investigators discovered that LockBit had not deleted victims' exfiltrated data as promised after ransom payment — the exact repeat-extortion risk Proofpoint's survey quantifies. Khoroshev was subsequently indicted on 26 counts in US federal court and sanctioned by the US, UK, and Australia, with a $10M US State Department reward for his arrest.

The second case study, Nitrogen, is a ransomware operation that emerged in 2023 as an initial-access loader for the BlackCat/ALPHV RaaS operation before evolving into an independent double-extortion ransomware group by late 2024, using code derived from the leaked Conti 2 builder and tradecraft overlapping with former BlackCat affiliates. Nitrogen's primary initial-access technique is malvertising: fraudulent, highly-ranked Google ads distribute trojanized installers of legitimate admin tools (WinSCP, AnyDesk, Advanced IP Scanner, PuTTY), delivered inside archives (e.g., 'Version.zip') containing a masqueraded, DLL-side-loaded Python interpreter. A documented September 2024 intrusion (analyzed in depth by The DFIR Report) shows the full kill chain: drive-by malvertising compromise, Sliver and Cobalt Strike beacon deployment via Py-Fuscate-obfuscated Python loaders, LSASS credential dumping (first local-admin, then domain-admin credentials within hours), BloodHound/PowerView/Impacket-driven AD discovery and lateral movement over RDP and SMB admin shares, Restic-based exfiltration to a Bulgaria-hosted REST server, and — roughly 156 hours after initial access — deployment of BlackCat/ALPHV ransomware via PsExec, preceded by Safe Mode boot reconfiguration, Volume Shadow Copy deletion, and mass Windows event-log clearing. In February 2026, researchers at Coveware disclosed that Nitrogen's own ESXi ransomware variant contains a memory-offset coding error that corrupts the RSA/Curve25519 public key during encryption, meaning even Nitrogen's own decryptor cannot recover encrypted ESXi hosts — converting a financially-motivated attack into irreversible destruction regardless of whether the ransom is paid. In May 2026, Nitrogen listed electronics manufacturer Foxconn on its 'NitroBlog' leak site, claiming roughly 8TB (11M+ files) of exfiltrated data including project documentation tied to Intel, Apple, Google, Dell, and Nvidia; Foxconn confirmed a cyberattack against its North American operations the following day.

Collectively, these case studies validate Proofpoint's core recommendation: because modern ransomware operators (a) do not reliably delete stolen data after payment and (b) increasingly launch follow-on extortion demands against prior payers, defenders should treat ransomware primarily as an identity, email, and trusted-communication problem rather than a purely endpoint/recovery problem, and should adopt payment policies that assume repeat extortion as the likely, not exceptional, outcome.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1569.002 Service Execution
- T1047 Windows Management Instrumentation
- T1098 Account Manipulation
- T1053.005 Scheduled Task
- T1547.004 Winlogon Helper DLL
- T1055.001 Dynamic-link Library Injection
- T1685.005 Clear Windows Event Logs
- T1574.001 DLL
- T1027.013 Encrypted/Encoded File
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1055 Process Injection
- T1688 Safe Mode Boot
- T1003.001 LSASS Memory
- T1539 Steal Web Session Cookie
- T1087.001 Local Account
- T1069.001 Local Groups
- T1069.002 Domain Groups
- T1482 Domain Trust Discovery
- T1135 Network Share Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1039 Data from Network Shared Drive
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1133 External Remote Services
- T1566 Phishing
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter

## Sources

- [Greedy ransomware crews return for seconds after victims cough up first extortion payments](https://databreaches.net/2026/07/22/greedy-ransomware-crews-return-for-seconds-after-victims-cough-up-first-extortion-payments/)
- [Over a third of ransomware victims re-extorted after paying](https://www.theregister.com/security/2026/07/22/over-a-third-of-ransomware-victims-re-extorted-after-paying/5276218)
- [2026 AI-Era Ransomware Report](https://www.proofpoint.com/us/resources/threat-reports/ai-era-ransomware-report)
- [Proofpoint Research Finds 65% of Organisations Affected by Ransomware Say AI Made Attacks More Effective](https://www.proofpoint.com/uk/newsroom/press-releases/proofpoint-research-finds-65-organizations-affected-ransomware-say-ai-made)
- [Understanding Ransomware Threat Actors: LockBit (AA23-165A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a)
- [#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE-2023-4966 Citrix Bleed Vulnerability (AA23-325A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a)
- [#StopRansomware: LockBit 3.0 (AA23-075A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a)
- [Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware](https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/)
- [Nitrogen can't unlock its own ransomware after coding error](https://www.theregister.com/security/2026/02/04/nitrogen-cant-unlock-its-own-ransomware-after-coding-error/4852991)
- [Foxconn confirms cyberattack after ransomware crew claims it stole confidential Apple, Nvidia files](https://www.theregister.com/cyber-crime/2026/05/12/foxconn-confirms-cyberattack-after-nitrogen-claims-apple-nvidia-data-theft/5239144)
- [Nitrogen Ransomware on a Manufacturer Attack Spree](https://www.halcyon.ai/ransomware-alerts/nitrogen-ransomware-on-a-manufacturer-attack-spree)
- [Nitrogen ransomware: From staged loader to full-scale extortion](https://blog.barracuda.com/2025/11/07/nitrogen-ransomware--from-staged-loader-to-full-scale-extortion)
- [US and UK Authorities Identify, Sanction and Unseal Indictment Against Leader of LockBit Ransomware Group](https://www.trmlabs.com/resources/blog/us-and-uk-authorities-identify-sanction-and-unseal-indictment-against-leader-of-lockbit-ransomware-group)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1710