Ransomware Without the Ransom: How Snowflake and the Extortion-Only Era Rewrote the Playbook

1. Ransomware without the ransomware#

In the summer of 2024, attackers walked into roughly 165 organizations' most sensitive data stores the same way an employee would. They typed a valid username and password and pressed enter. No zero-day. No malware planted on the servers. No encrypted files, no locked screens, no countdown timer. They logged in to each company's Snowflake tenant, ran a single bulk-export command -- COPY INTO -- and copied the data out ^[1]. Among the exposed: the call and text records of nearly all of AT&T's wireless customers, roughly 110 million people ^[2]. Ticketmaster and Live Nation. Santander.

And here is the part that should keep a security architect awake: Snowflake's own platform was never breached, and not one file was ever encrypted. So where did the "ransom" in ransomware go, and why did dropping it make the attack worse?

Start with the distinction the entire architectural lesson rests on, because almost every headline got it subtly wrong. The attackers did not break Snowflake. They logged in to Snowflake customers' accounts using credentials those customers had already lost to commodity malware, and Snowflake the platform kept doing exactly what it was designed to do: authenticate a valid login and run a valid query ^[1].

The failure lived on the customer's side of a line that most people did not know was there. AT&T's own filing with the Securities and Exchange Commission is careful about scope: the exfiltrated records were call and text metadata -- who contacted whom, and when -- not the content of any call or message, and they came from "a third-party cloud platform" workspace, not from AT&T's core network ^[2].

That precision matters, because this is a post-mortem, not a scare story. Throughout, "roughly 165 organizations" means notified as potentially exposed -- the population Mandiant and Snowflake warned that their tenants may have been accessed. It is not a count of 165 confirmed, fully-exfiltrated breaches. The distinction between "notified" and "breached" is exactly the kind of imprecision this article tries to avoid ^[1]. The number 165 is a notification count, not a body count, and the difference is the sort of thing the rest of this piece will insist on.

Set against thirty-five years of received wisdom, the 2024 Snowflake campaign is a paradox. Everyone knows what ransomware is: it encrypts your files and demands Bitcoin for the key. Yet the most consequential extortion event of the year contained no encryption at all, and it was more damaging for the omission, not less.

To see why, this article answers three questions in order. First, where did the encryption go -- why would a mature criminal industry abandon its signature weapon? Second, why did removing that weapon make the attack stronger rather than weaker? And third, what actually failed, if not a cipher?

The short answer to the third question, which the next eleven sections will earn rather than assert, is that nothing cryptographic failed. What failed was the access layer -- a stolen identity here, an unauthenticated application flaw there -- and it failed against software that the victim did not fully control. But to understand why the biggest attack of the year had no ransomware in it, we have to go back to the moment ransomware was born, and see that the encryption was a historical accident, not the point.

2. What "ransomware" used to mean#

In December 1989, Dr. Joseph L. Popp Jr. -- a Harvard-trained evolutionary biologist ^[3] -- mailed about 26,000 floppy disks to subscribers of a mailing list, addressed to recipients in roughly 90 countries. The disks were labelled "AIDS Information -- Introductory Diskettes," and they did contain a real questionnaire that scored the reader's risk of contracting AIDS ^[4]. They also contained the first piece of ransomware ever written.

The program, later known as the AIDS Trojan or PC Cyborg, installed itself quietly and counted boot cycles. After roughly the ninetieth restart, it hid the directories on the C: drive and scrambled the file names, then printed a demand: lease the "software" for 189 US dollars for 365 uses, or 378 US dollars for a lifetime, payable to the "PC Cyborg Corporation" at a post-office box in Panama ^[4].

Popp's invention was not technical. No template for monetized malware existed yet, and his contribution was the extortion transaction -- the idea that you could hold a stranger's computer hostage for money. The cryptography was an afterthought.

And it showed. The AIDS Trojan used a weak symmetric substitution cipher: the same secret that scrambled the file names could unscramble them, and that secret was sitting in the code. Within weeks, the British antivirus researcher Jim Bates disassembled the program for the January 1990 issue of Virus Bulletin and wrote recovery tools, AIDSOUT and CLEARAID, that undid the damage without paying anyone ^[5]. The coercive hold evaporated the instant an analyst read the code. Bates's CLEARAID was, as far as anyone can tell, the first-ever ransomware decryptor. Hold that image: a defender ships a free tool that dissolves the attacker's power overnight. It is the 1989 rehearsal of a story that repeats, almost beat for beat, with BianLian thirty-three years later ^{[5, 6]}.

The obvious fix was better cryptography, and the blueprint arrived before the crime industry was ready to use it. In 1996, Adam Young and Moti Yung presented a paper at the IEEE Symposium on Security and Privacy with a deliberately unsettling title: "Cryptovirology: Extortion-Based Security Threats and Countermeasures" ^[7]. They asked what a cryptographically sound version of Popp's attack would look like, and they answered it in full.

Young and Yung had, on paper, made the AIDS Trojan's fatal flaw impossible. A defender could disassemble the malware all day and never recover the key, because the key that mattered was never present to be found. What the blueprint lacked was infrastructure: an always-on network to ferry keys back to the attacker, and an anonymous, irreversible way to collect money that a post-office box in Panama could never provide.

Both arrived by 2013, and CryptoLocker fused them. It encrypted each file with a fast symmetric (AES) key and then encrypted that key under the attacker's RSA public key, connecting to a command-and-control server that held the matching private key "out of the victim's reach," and demanded payment in MoneyPak or Bitcoin within about 72 hours ^[8]. Bitcoin solved the payment-anonymity problem the AIDS Trojan never could; strong asymmetric crypto solved the reversibility problem that Jim Bates had exploited. For the first time, the theory and the plumbing lined up. This is the moment file-encrypting ransomware became a scalable business rather than a curiosity.

Step back and notice what had happened to the very meaning of the word. For thirty-five years -- from Popp's disks through CryptoLocker and the ransomware-as-a-service brands that followed -- "ransomware" was defined by cryptography. The coercive power was always framed as a single sentence: you cannot read your own files. Defenders learned to think of the cipher as the weapon, and of key strength as the measure of the threat. The stronger the cryptography, the more dangerous the attack.

The 1996 blueprint had made that cryptography, in principle, unbreakable. So the attackers had won the crypto war permanently -- had they not? One boring, unglamorous defensive practice, one that no advance in cryptography could touch, was about to prove they had been fighting the wrong war all along.

3. The encryption machine and its one weakness#

The unbreakable cipher had a mundane counter that no cryptanalysis could touch, and it fit in a single word: backups.

Through the second half of the 2010s, file-encrypting ransomware industrialized. It stopped being a lone program and became a supply chain -- a ransomware-as-a-service model in which one crew built and maintained the encryptor and the key infrastructure, and a network of "affiliates" rented the tooling to break into victims and split the proceeds. The pieces became recognizable and branded: an encryptor binary, a central key server that held the private keys, a negotiation portal, and, soon, a public leak site.

Around Ryuk in early 2019 the strategy acquired a name: "big game hunting," the deliberate targeting of large enterprises whose downtime was expensive enough to justify a bespoke intrusion. CrowdStrike popularized the term "big game hunting" in a January 2019 write-up of Ryuk, though it had used the phrase in earlier reporting. The shift mattered because it changed the arithmetic: a victim rich in valuable data was now worth the extra effort of a hands-on-keyboard intrusion, which is exactly the arithmetic that later makes a data warehouse an irresistible target ^[9].

The business was formidable, but it rested on one assumption that a defender could quietly dismantle. Encryption attacks the availability of your data -- it does not steal the data, it merely puts it out of reach. And availability is the one property you can restore yourself. If you keep an offline, immutable copy of your data, then when the encryptor fires you wipe the machines, restore from the copy, and you are back in business without paying anyone.

This is why the government's ransomware guidance does not open with cryptography at all. CISA's #StopRansomware advisories put maintaining regularly tested, offline, encrypted backups near the very top of the recommended mitigations, ahead of almost everything else ^[10].

Backups were not the only way to undo an encryption attack, and the second way should have worried the industry even more, because it did not depend on the victim at all. If the whole model funnels its power through a single set of private keys held on central infrastructure, then anyone who seizes that infrastructure can hand the keys back to every victim at once. Law enforcement noticed.

When the FBI disrupted the Hive group in 2023, it revealed that for the previous seven months it had quietly held Hive's keys and offered decryptors to more than 1,300 victims worldwide, preventing an estimated 130 million dollars in ransom payments ^[11]. A year later, Operation Cronos seized LockBit's administration environment, its source code, and roughly 1,000 decryption keys ^[12]. In both cases the cryptography was flawless and completely beside the point. The coercive power lived in a place the police could reach and copy.

So the encryption model had two independent reversibility channels working against it. The victim could restore from backup, and the state could seize the keys. Neither is a cryptographic weakness -- you cannot cryptanalyze a backup or a search warrant -- and that is precisely why they were so effective. The attackers had spent twenty years perfecting a lock, and defenders had simply started keeping a second copy of everything behind it.

A backup could restore a file. Law enforcement could restore a key. But what if the attackers held something that neither a backup nor a warrant could ever bring back? In November 2019, one group asked exactly that question -- and in answering it, re-armed the entire business for the decade to come.

4. The evolution, generation by generation#

Watch one thing across five generations of attackers, and the whole history snaps into focus: the encryption steadily loses relevance while the coercive hold -- control of the data -- never changes hands. Each generation is a fix for the way the previous one could be undone.

timeline
title From cipher to copy: five generations of extortion
1989 : AIDS Trojan, reversible symmetric crypto (Gen 0)
1996 : Young-Yung cryptovirology, the public-key blueprint
2013 : CryptoLocker, strong crypto plus Bitcoin (Gen 1)
2019 : Maze, double extortion, steal then leak (Gen 2)
2020-2023 : Cl0p file-transfer zero-days, mass exfiltration (Gen 3)
2024 : Snowflake, identity-driven SaaS extortion (Gen 4)
2025-2026 : Oracle EBS and PeopleSoft, pure zero-day extortion (Gen 5)

Generation 0 -- reversible symmetric extortion. Popp's 1989 AIDS Trojan denied availability with a cipher you could read out of the code, and Jim Bates's free decryptor undid it ^[5]. The coercive hold lasted exactly as long as it took an analyst to look.

Generation 1 -- cryptographically sound single extortion. The Young-Yung blueprint plus CryptoLocker's C2-held private keys and Bitcoin fixed the cipher for good ^[8]. But fixing the cryptography did not fix the model, because the damage was still an availability denial, and availability answers to backups and to seized keys. The unbreakable lock met the spare copy, and the spare copy won.

Generation 2 -- double extortion. In November 2019 the Maze crew asked what backups could not fix, and found the answer: steal the data before encrypting it, then threaten to publish it. The first widely reported case was the security firm Allied Universal, which refused a demand of roughly 300 Bitcoin -- about 2.3 million US dollars at the time -- whereupon Maze leaked a sample of the stolen files and stood up the first dedicated leak site to host the rest ^[13].

Double extortion is the hinge of the entire story, and its deepest implication took the industry years to act on. Once the leak threat is in play, the encryption is doing something the theft already did -- and doing it more loudly and more expensively. The encryption half had quietly become redundant overhead.

Generation 3 -- mass zero-day exfiltration. The next crew to move drew the obvious conclusion and skipped the encryption entirely. Beginning around 2020, the group tracked as Cl0p (also TA505) stopped breaking into victims one at a time and instead hunted for a single unauthenticated flaw in software that thousands of organizations run at their network edge.

Cl0p's file-transfer lineage runs straight through that niche: Accellion FTA in 2020 to 2021, then Fortra GoAnywhere via CVE-2023-0669 ^[14], then Progress MOVEit via CVE-2023-34362, an unauthenticated SQL-injection flaw exploited in the wild in May and June 2023 ^[15]. The MOVEit campaign alone reached roughly 2,773 organizations and the records of about 95.8 million individuals ^[16]. No encryptor was involved. The government's own advisory records the pivot in plain language.

"In recent campaigns beginning 2021, CL0P preferred to rely mostly on data exfiltration over encryption." -- CISA and FBI, joint advisory AA23-158A

That single sentence, from CISA and the FBI, is the encryption-less thesis stated by the defenders themselves ^[10]. And the economics behind it are worth seeing as a picture, because they explain why this generation scales the way it does.

flowchart LR
A["One unauthenticated zero-day in shared internet-facing software"] --> B["Web shell or agent deployed per instance"]
B --> C["Victim org 1"]
B --> D["Victim org 2"]
B --> E["Victim org 3"]
B --> F["Victim org N"]
F --> G["MOVEit reached about 2,773 orgs and 95.8M people"]

The failure mode of Generation 3 is that a fresh unauthenticated zero-day is expensive to obtain and perishable once used at scale -- burned within days as vendors rush out patches. Which raises the question the next generation answered: what if you did not need a zero-day at all?

Generation 4 -- identity-driven SaaS extortion. In 2024 the Snowflake campaign showed you could reach a data warehouse holding hundreds of millions of records with nothing more exotic than a valid password bought from an infostealer log, provided the account lacked multi-factor authentication ^[1]. No exploit, no encryptor -- just a login and COPY INTO. This is the cheapest attack in the whole lineage, and its only failure mode is that a defender can close it with basic identity hygiene. The US Department of Justice indicted Connor Riley Moucka ("Judische") and John Erin Binns over the Snowflake-related extortion; the indictment was filed October 10, 2024 ^[17]. Moucka's widely cited October 30, 2024 arrest in Canada comes from contemporary reporting, not the DOJ case page, which anchors only the indictment and the 2025 extradition. Where a date rests on reporting rather than a filing, this article says so.

Generation 5 -- pure zero-day extortion at ERP scale. By 2025 and 2026 the encryptor was fully vestigial. Cl0p turned its shared-software playbook on Oracle's E-Business Suite, and the ShinyHunters brand turned an Oracle PeopleSoft flaw into a campaign against universities ^{[18, 19]}. The model had been reduced to its essence: get access, copy the data, extort. Section 6 dissects both campaigns in detail.

There is one more thread that does not fit the neat generational spine, and it is the most telling of all, because it happened inside one of the most prolific encryption operations in history. In mid-2022, CISA and the FBI documented Karakurt, a data-extortion group that -- unusually for the era -- did not encrypt anything.

Karakurt actors stole data and threatened to auction it, demanding between 25,000 and 13 million US dollars in Bitcoin, and they got in through thoroughly access-layer means: purchased stolen credentials and compromised Cisco AnyConnect VPN accounts where, as the advisory notes, "multi-factor authentication was not enforced" ^[20].

What makes Karakurt a witness rather than a footnote is its parentage. Researchers linked it operationally to the Conti and Diavol groups -- it reused the exact Cobalt Strike backdoor Conti left behind -- and described it as "the trial run of a strategic diversification authorized by the main group" ^[21]. The pivot from encryption to pure theft was not a fringe experiment by minor crews. It was rehearsed at the center of the ransomware economy, deliberately.

Laid side by side, the generations tell a single story.

Read the last two columns together. As the source of coercion migrates from "denied availability" to "threat of disclosure," the "what could undo it" column stops offering a cure and starts offering only prevention. By 2024 the cipher was gone and the business was larger than ever. That is not an accident of tooling. It is the visible symptom of a mistake buried in the original definition of ransomware -- and it is time to name it.

5. The breakthrough: encryption was always the costly part#

Here is the reframe the whole history has been pushing toward. Separate what actually forces the victim to pay from the mechanism the attacker used to deliver the threat. What forces payment is the attacker's control over the data -- the credible threat "we have your records and we will publish them." Encryption was only ever one way to deliver a threat, and it was always the disposable one.

For thirty-five years the two things looked like a single thing, because in Popp's model and in CryptoLocker's they were fused: the attacker's control was the encryption. Double extortion pried them apart. The moment Maze stole the data before encrypting it, the theft carried the real threat and the encryption became a second, redundant delivery channel for a message the theft had already sent. Once you see the two as separate, the question stops being "how strong is the cipher?" and becomes "which delivery mechanism is cheaper, quieter, and harder to undo?" -- and by that measure, encryption loses badly.

Consider what running an encryptor actually costs a criminal operation. You have to develop and maintain the malware. You have to run key infrastructure and, in effect, staff a decryptor "support desk" so paying victims can actually recover -- because a group that cannot reliably decrypt stops getting paid. The attack is loud: encrypting thousands of files means a storm of file writes that endpoint-detection tools are specifically tuned to notice, often while the operation is still in progress. And, as three sections have hammered, it is reversible -- by backups, by seized keys, by a free decryptor.

Now consider exfiltration. Copying data out is cheap -- often just a native export feature used with valid access. It is quiet, because a bulk read can look exactly like a legitimate analytics job. And it is -- the load-bearing word of this entire article -- permanent. Once the data is copied to a machine the attacker controls, no action by the victim can reverse the disclosure. There is no backup for a secret.

Encryption was never the source of the attacker's power. It was a reversible delivery mechanism for the real power: control of the data. Drop the mechanism and you lose nothing that mattered -- you shed cost, noise, and reversibility while keeping, and even strengthening, the one thing that makes a victim pay. A leak is forever.

This is not a thought experiment. The record contains not one but two clean natural experiments, and the first is almost too on-the-nose. In January 2023 the antivirus firm Avast released a free decryptor for the BianLian ransomware. Overnight, BianLian's encryption stopped working as a threat -- any victim could now restore for free, exactly as Jim Bates's CLEARAID had let AIDS Trojan victims recover in 1990.

BianLian's response tells you everything about where the real power lived: the group stopped encrypting victims' files altogether and shifted to pure data-theft extortion ^[6]. When the cipher was made reversible, the criminals did not try to build a better cipher. They threw the cipher away and kept extorting, because the data theft alone was enough.

The second experiment is stronger, because nobody forced it. BianLian dropped encryption after a decryptor took the choice away; Karakurt dropped it while the cipher still worked perfectly.

As Section 4 noted, Karakurt ran an exfiltration-only operation with no encryptor at all, and researchers assess it was a "strategic diversification authorized by the main group" behind Conti -- a deliberate, unforced decision by one of the most capable encryption crews on earth to spin up a division that does not encrypt ^{[20, 21]}. When the people who own a world-class encryptor choose to build a business that never uses it, the encryptor was not the asset. The data was.

A backup restores a file. It cannot restore a secret already copied out.

Honesty requires a caution here, because a clean story is a suspicious one. The claim is not that encryption vanished or that every attacker reasoned this through and abandoned it. Some of the most active brands of 2025, Akira and Qilin among them, still encrypt -- each accounted for about 16 percent of claimed attacks in one 2025 tally ^[22]. Encryption survives, for reasons Section 7 examines, wherever the ability to deny availability still adds pressure a leak threat cannot.

The argument of this section is an interpretation of the economics, not a claim that the encryptor is extinct. What the economics establish is a direction: as the leak threat became the center of gravity, the incentive to carry an expensive, noisy, reversible encryptor steadily weakened, and for a growing share of attackers it fell below the line where it was worth the trouble.

So if encryption is the disposable part, the real question was never how they lock the data but how they reach it in the first place. That is where the confidentiality attack begins, and it is the only part of the model that still matters. In the 2024 to 2026 era, the question of how attackers reach the data has exactly two answers -- and neither one is a broken cipher.

6. The extortion-only playbook: two access vectors#

Every encryption-less campaign of this era gets in through one of two doors. Neither door is a broken cipher, and telling them apart matters, because each is closed by a different control.

flowchart TD
A["Access-layer failure, never a cryptographic break"] --> B["Identity vector: stolen credential on an MFA-less account (Snowflake)"]
A --> C["Zero-day vector: unauthenticated app RCE that bypasses identity (Cl0p to EBS, ShinyHunters to PeopleSoft)"]
B --> D["Third-party and cloud shared-responsibility gap"]
C --> D
D --> E["Data copied out, irreversible"]

6a. Door one: a stolen identity#

The Snowflake campaign is the reference case for the identity vector, and its supply chain starts nowhere near Snowflake. It starts on somebody's laptop.

The chain runs like this. An infostealer lands on an endpoint -- often a contractor's or a personal device also used for gaming or pirated software -- and siphons its saved credentials into a log. A buyer acquires the log. If any of those credentials open a Snowflake tenant that does not enforce multi-factor authentication, the attacker simply signs in through the native web console (SnowSight) or command-line client (SnowSQL), runs reconnaissance, and issues COPY INTO to export the data.

Mandiant found the enabling conditions were remarkably durable: at least 79.7 percent of the abused accounts had prior credential exposure, and the earliest enabling infostealer infection dated all the way back to November 2020 ^[1]. Some of those passwords had been sitting in criminal hands for over three years.

The root cause here is identity, full stop -- not a flaw in Snowflake's platform, which authenticated valid logins exactly as designed. Keep three labels distinct. UNC5537 is Mandiant's name for the intrusion actor behind the Snowflake campaign. ShinyHunters is a public extortion persona/brand. UNC6240 is Mandiant's cluster for the ShinyHunters-branded PeopleSoft activity in 2026. They are related threads in one loosely federated nexus, not a single group -- and conflating them is a common way the reporting on this era goes wrong ^{[1, 19]}. Contractor and bring-your-own-device endpoints act as an amplifier: one compromised laptop used to administer several clients can unlock several tenants at once. The broader data agrees with the specific case. IBM's 2024 breach study ranked stolen or compromised credentials the single most common initial attack vector at 16 percent, and the slowest to contain, at nearly ten months ^[23].

flowchart TD
A["Infostealer on a contractor or BYOD laptop"] --> B["Credentials sold in an infostealer log"]
B --> C["Login to an MFA-less Snowflake tenant via SnowSight or SnowSQL"]
C --> D["FROSTBITE recon enumerates users, roles, and sessions"]
D --> E["COPY INTO bulk export copies the data out"]
E --> F["Extortion demand or sale of the data"]

The reconnaissance step used a custom utility Mandiant tracks as FROSTBITE. ※ Mandiant assigned the neutral name FROSTBITE to the reconnaissance tool the actor had given a crude name; the sanitized label is used throughout the reporting and here ^[1]. Precisely what FROSTBITE enumerated is worth stating exactly, because it is easy to overclaim: Mandiant reports it collected users, current roles, current IPs, session IDs, and organization names -- session and identity context, not a catalogue of every table ^[1].

The broader survey of what data was reachable came from ordinary SQL clients that any analyst would use. Legal consequences did follow -- the US Department of Justice indicted Connor Riley Moucka and John Erin Binns over the campaign on October 10, 2024 ^[17] -- but consequences after the fact do not un-copy the data.

What makes this vector so hard to catch is that every step is a legitimate action performed by a valid identity. A bulk COPY INTO looks like an analytics export because, mechanically, it is one. The signals that remain are indirect: volume, novelty of the source location, timing, and egress off the platform.

// Defensive heuristic only. Each signal below is legitimate in isolation --
// which is exactly why a valid COPY INTO is hard to catch.
function scoreExfilRisk(ev) {
let score = 0;
if (ev.rowsExported > 1_000_000) score += 3;          // bulk volume
if (!ev.sourceIpSeenBefore) score += 3;               // novel location
if (ev.hourOfDay < 6 || ev.hourOfDay > 22) score += 2;// odd hours
if (ev.destinationIsExternal) score += 3;             // egress off-platform
if (ev.priorFailedLogins > 0) score += 1;             // credential-stuffing hint
return score; // a score of 6 or more warrants human review
}

const nightlyAnalytics = { rowsExported: 2_000_000, sourceIpSeenBefore: true,
hourOfDay: 14, destinationIsExternal: false, priorFailedLogins: 0 };
const snowflakeStyleExfil = { rowsExported: 40_000_000, sourceIpSeenBefore: false,
hourOfDay: 3, destinationIsExternal: true, priorFailedLogins: 2 };

console.log("legit nightly analytics ->", scoreExfilRisk(nightlyAnalytics));     // 3: below threshold
console.log("Snowflake-style exfiltration ->", scoreExfilRisk(snowflakeStyleExfil));// 12: review
console.log("The login was valid in both cases. Only volume, novelty, timing, and egress separate them.");

The good news about the identity vector is that it is closable in principle: enforce phishing-resistant multi-factor authentication, restrict admin surfaces to known networks, and rotate credentials after any exposure, and this door does not open. The bad news is that attackers have a second door that does not care about identity at all.

6b. Door two: an unauthenticated zero-day#

The second door does not steal an identity. It walks past the identity system entirely.

Two 2025 to 2026 campaigns define this vector, and they must never be treated as one. In the first, the Cl0p group turned its shared-software playbook on Oracle's E-Business Suite via CVE-2025-61882, an unauthenticated remote-code-execution flaw rated CVSS 9.8 ^[24].

Google's threat group traced exploitation of a UiServlet component to July 2025 and a SyncServlet component to August 2025 ^[18]. The exploit was not one bug but a chain: watchTowr's analysis of the leaked exploit found at least five distinct flaws orchestrated together -- server-side request forgery, CRLF injection, an authentication bypass, and XSL template injection -- to reach pre-authenticated code execution ^[25]. The chain leaked publicly in a "Scattered Lapsus$ Hunters" Telegram channel on October 3, 2025, and Oracle shipped emergency patches on October 4 and October 11 ^[18].

In the second, the ShinyHunters brand -- tracked by Mandiant as UNC6240 -- exploited Oracle PeopleSoft via CVE-2026-35273, also an unauthenticated flaw rated CVSS 9.8, affecting PeopleTools 8.61 and 8.62 ^[26]. After gaining access, the actor deployed MeshCentral remote-management agents disguised as Azure binaries, beaconing to a command channel at wss://azurenetfiles.net:443/agent.ashx; Google reported the campaign touched more than 100 organizations, roughly 68 percent of them academic institutions, with victims' data published to the ShinyHunters leak site ^[19].

Now the point that unifies both doors. They look nothing alike -- one is a bought password, the other a five-bug exploit chain -- but they fail on the same boundary, and it is not a cryptographic one.

A third door is opening that makes the point sharper still: abusing machine identity. In August 2025 the actor tracked as UNC6395 used compromised OAuth tokens for the Salesloft Drift integration to reach downstream Salesforce tenants, then mined the exports for AWS and Snowflake tokens to pivot further. Google was explicit that "this issue does not stem from a vulnerability within the core Salesforce platform" ^[28]. A standing OAuth token is an identity no user-facing MFA touches, and note the recursion: the tokens it harvests feed straight back into door one. Section 9 returns to this frontier.

Two doors, and no broken cipher between them -- the thesis, discharged against the live campaigns. But that raises an uncomfortable question. If encryption-less extortion is so dominant, why are there still more encrypting attacks than data-theft-only ones? The answer is a trap hidden inside a single word: dominant.

7. The counter-signal: encryption is not dead#

Everything above argues that encryption is obsolete. Here is the honest catch that keeps the argument from becoming a lie: it depends entirely on which number you look at, and the two most-cited numbers point in opposite directions.

Measured by tracked extortion cases, data-theft-only is now the majority. Resilience reported that data-theft-only attacks made up about 57.6 percent of extortion claims in 2025, rising from 49 percent in the first half of the year to 65 percent in the second ^[29]. CyTwist put encryption-less extortion at roughly 52 percent of observed incidents, surpassing traditional ransomware ^[30]. On that denominator, the shift this article describes is not subtle -- it is the new majority.

Measured by raw ransomware incident count, encryption is still ahead. Symantec counted 4,737 claimed (encrypting) attacks in 2025 against 6,182 total extortion attacks, which leaves roughly 1,445 data-theft-only cases -- an encryption-to-pure-theft ratio of about three to one ^[22]. A readable secondary summary makes the swing vivid: the number of incidents relying on data theft alone rose to almost 1,500 in 2025, up from just 28 the year before ^[31]. Encrypting brands remained the largest single bucket, with Akira and Qilin each claiming about 16 percent of attacks ^[22].

Both numbers are correct. They answer different questions, and the entire confusion around "is ransomware dead?" comes from mixing them.

Why does encryption persist at all, if the leak threat is the real source of coercion? Because encryption does one thing pure exfiltration cannot: it denies availability. Extortion comes in grades -- single (encrypt only), double (steal and encrypt), triple (add a distributed denial-of-service attack or direct harassment of the victim's customers), and pure exfiltration (steal only).

The surviving hybrid, double and multi-extortion with encryption, is carried today by brands such as Akira, Qilin, DragonForce, and Safepay. For them the encryptor is a genuine availability weapon: it halts operations and manufactures urgency in a way that a quiet data theft does not.

Coveware found exfiltration present in about 74 percent of its second-quarter 2025 cases and attributes that quarter's record average and median ransom payments, roughly 1.13 million and 400,000 US dollars, to data-exfiltration-only incidents at larger organizations, while separately noting that encryption attacks still cause the most impact and urgency ^{[32, 33]}. Where a victim's backups are weak, availability denial still pays.

That gives four live methods, chosen by attackers according to the target in front of them.

The methods are complementary, not successive. An attacker starts with the cheapest door that works: identity, if the target's credentials are weak. If identity is hardened, they reach for a pre-auth zero-day, or ride a trusted integration's token. They add encryption only when denying availability buys pressure the leak alone does not. Harden one door and the attacker walks to the next.

Notice, though, what the whole table has in common. Read down the "reversible by backups?" row: encryption is reversible, and the leak, every time, is not. Encryption survives precisely because backups can undo it -- it is useful against victims who cannot undo it themselves. That word, undo, is the entire game. And there is exactly one kind of loss that nothing can undo. It sets a hard limit on every defense in this article.

8. You cannot back up your way out of a leak#

Every reversal in this story -- the free decryptor, the offline backup, the seized key -- undoes the same kind of damage. And there is a precise, almost mathematical reason they all work on encryption and none of them work on a leak.

Availability attacks are reversible; confidentiality attacks are not. Encryption denies you the use of data you still hold, and that denial has an inverse. Exfiltration copies data to someone else, and disclosure has no inverse. Against exfiltration, prevention is the only control that can truly succeed -- detection and response can bound the damage, never reverse it.

flowchart TD
A["What did the attack take?"] --> B["Availability (encryption)"]
A --> C["Confidentiality (exfiltration)"]
B --> D["Reversible: restore from backup, seized or leaked key, or free decryptor"]
C --> E["Irreversible: no operation un-discloses a secret"]

The historical record makes the left branch concrete. A free decryptor collapsed BianLian's encryption overnight ^[6]. The FBI's covert access to Hive's keys let it hand decryptors to more than 1,300 victims ^[11]. Operation Cronos recovered roughly 1,000 of LockBit's keys ^[12]. Every one of those is a reversal -- availability restored without the attacker's consent. The right branch has no such entries, and it never will, because it is asking for something that does not exist: an operation that makes a copied secret un-copied.

That yields three impossibility results that bound the entire problem.

One: you cannot back up your way out of a leak. No defensive technology reverses disclosure. This is not an engineering gap awaiting a better tool -- it is a property of information itself. A backup is a second copy; the attack was already a second copy going the other way ^[6].

Two: "deletion" is unverifiable. Paying an extortionist to delete their copy asks them to prove a negative -- that no other copy persists anywhere -- which is impossible to verify and trivial to violate. The uncomfortable part is that victims pay anyway.

Coveware found that through the second quarter of 2025 the payment rate for data-exfiltration-only cases increased and "remains in a stubbornly high bracket," even as the overall share of victims paying held near 26 percent ^[32]. The frontier is not that victims stopped paying for deletion; it is that they keep paying, at high and rising rates, for a promise no one can confirm was kept.

The evidence that the promise is often broken is direct. Resilience warns that paying to suppress stolen data "has proven unreliable -- data often resurfaces, notification obligations still apply, and class action lawsuits frequently follow" ^[29]. From the offense side, Karakurt was documented keeping a copy of stolen data even after a victim paid for deletion ^[21].

AT&T is the cautionary case in the flesh. Its SEC filing confirms the scope: the call and text metadata of roughly 110 million customers, exfiltrated from a third-party cloud workspace ^[2]. Contemporary reporting says AT&T paid about 370,000 US dollars for deletion ^[34] -- but a deletion payment buys a promise, not proof. No victim can confirm every copy is gone, and Mandiant documents the campaign's stolen data being advertised and sold on criminal forums ^[1]. You cannot buy back a secret.

Three: the shared-responsibility gap is structural, not a bug. An organization cannot unilaterally secure data it has handed to a third party -- and that boundary is exactly where Snowflake's customer accounts, the customers' internet-facing Oracle instances, and the Salesloft Drift integration all failed. Google draws the same lesson from the platform side, framing these campaigns as underscoring "the importance of a shared responsibility model for cloud security" ^[27]. It is a permanent seam, not a fixable defect.

Resilience's own framing of the era: security controls stop at the network perimeter, but risk exposure runs on, through every vendor a company relies on.

The remediation follows from that boundary: because the exposure runs through vendors you do not control, prevention has to happen before the data ever reaches the seam ^[29]. The asymmetry is clearest in code.

// Encryption denies availability -- and availability has an inverse.
function restoreFromBackup(state) {
return { ...state, filesAvailable: true }; // the backup is the undo button
}

// Exfiltration denies confidentiality -- there is no inverse to call.
function unLeak(secret) {
// No implementation can exist: the copy already left the building.
throw new Error("unLeak() is not implementable: a disclosed secret cannot be un-disclosed");
}

// Paying for "deletion" asks the attacker to prove a negative.
function payForDeletion() {
return { promise: "deleted", verifiable: false }; // unverifiable by construction
}

const encrypted = { filesAvailable: false };
console.log("after restore ->", restoreFromBackup(encrypted));      // filesAvailable: true
try { unLeak("customer call records"); } catch (e) { console.log("after leak ->", e.message); }
console.log("pay-for-deletion ->", payForDeletion());               // verifiable: false

If prevention is the only control that can truly succeed, does that mean defense is hopeless? No -- but it means the best achievable defense is asymptotic.

You cannot drive the risk to zero, but you can shrink the blast radius of every failure: minimize the data you hold (you cannot leak what you never collected), tokenize sensitive fields so a stolen copy is worthless without a separate vault, encrypt data at rest under keys the attacker cannot reach (the defender's mirror image of the attacker's abandoned tool), and make every identity ephemeral and least-privileged. Each of these shrinks the loss; none reaches zero, because some plaintext must exist somewhere for the business to run, and that residual is the irreducible target.

The limit, then, is structural rather than technological. If the cipher cannot be the battleground and the backup cannot be the cure, the war moves to the access layer -- to identities, internet-facing applications, and third-party trust. That war is very much in progress, and the next section maps the fronts where defenders are still losing.

9. Open problems on the access-layer frontier#

Every control in the next section is a way of losing more slowly. These are the fronts where defenders are still, structurally, losing -- and not one of them is a cryptography problem.

The infostealer supply never dries up. Valid credentials are a cheap, liquid commodity. Infostealers harvest logins continuously and feed marketplaces, so credentials are often exposed years before they are used -- the earliest enabling infection in the Snowflake campaign dated to November 2020 ^[1]. IBM ranks stolen credentials the top initial vector and the slowest to contain ^[23]. Phishing-resistant authentication defeats the use of a stolen credential, but nothing yet attacks the supply. Defense is entirely consumption-side, which means the raw material for door one is effectively unlimited.

Machine identity has no lifecycle. Service accounts, API keys, and OAuth tokens are identities that no user-facing multi-factor prompt ever touches. They tend to be standing, over-permissioned, and rarely rotated. UNC6395 rode Salesloft Drift's tokens straight past Salesforce's user authentication ^[28], and the industry has no mature, widely deployed lifecycle for issuing, scoping, monitoring, and expiring non-human identities the way it now manages human ones. This is door three, and it is wide open.

Concentration fights its own defense. The economic case for a cloud data warehouse is that it puts everything in one queryable place. That is also its security problem: concentration multiplies the blast radius of any single access failure. The business pull toward central analytics runs directly opposite the security pull toward dispersal and minimization, and there is no clean resolution -- every organization is negotiating the trade-off by itself.

Bulk theft looks exactly like bulk analytics. The hardest detection problem in this article is that a malicious COPY INTO or a rogue Data Loader export is, mechanically, a legitimate feature used by a valid identity. Attackers deepen the camouflage by living off the land -- Symantec observed PowerShell in about 25 percent of incidents and PsExec in about 22 percent, both normal administrative tools ^[22]. UNC6395 went further and deleted its own query jobs after exfiltration to erase the obvious trace, though platform-side logs survived ^[28]. When the attacker uses your own features and then tidies up, "anomaly detection" has very little anomaly to find. The residual signals -- volume, novelty, timing, egress -- are exactly the noisy, false-positive-prone ones the earlier scoring demo illustrated.

MFA adoption is an organizational problem, not a technical one. The technology to close door one has existed for years. The gap is deployment: legacy protocols, service accounts, contractor carve-outs, and "temporary" exceptions that become permanent. Every unmanaged exception is a re-opened door, and no amount of better cryptography closes a door someone chose to leave ajar.

The brands survive their own takedowns. Law enforcement can seize infrastructure, as it did with Hive and LockBit, but the 2024 to 2026 nexus is loosely federated rather than corporate. Personas and coalitions -- ShinyHunters, "Scattered Lapsus$ Hunters," the broader "The Com" -- reconstitute across platforms faster than any single takedown can suppress, and extortion-as-a-service lowers the barrier for the next entrant ^[32]. You cannot arrest a brand.

Nobody can verify that paying for deletion works, yet victims keep paying. This is the one frontier that is not an open research problem but a permanent one. As Section 8 showed, deletion is unverifiable in principle, yet the incentives keep victims paying at high rates for a guarantee no one can give.

The honest summary of this frontier is that the attacker's cost to reach data keeps falling while the defender's cost to protect an unbounded, third-party-spanning surface keeps rising. Cryptography solved its part of the problem so completely that attackers stopped attacking it. What remains is harder, because it is not a math problem at all -- it is a problem of who you trust, with what, and for how long. Which is why the practical guide that follows is written in the language of identity, patching, and vendor trust, not keys and ciphers.

10. Defending when identity is the perimeter and the vendor is the attack surface#

You cannot patch the confidentiality asymmetry. You can shrink the surface an attacker reaches through and the blast radius of any single failure. The playbook is three doors and a spine that runs under all of them.

Door one, the identity vector. The single control that closes it is not "MFA" in the abstract but phishing-resistant MFA, everywhere, with no exceptions.

One precise point about what that control covers, because this is where well-meaning advice often goes wrong. Mandiant attributes the Snowflake access specifically to stolen passwords on accounts that lacked MFA -- not to replayed session tokens ^[1]. Phishing-resistant MFA closes that password path completely: a FIDO2 credential is bound to the site's origin, so a password lifted from an infostealer log, or even fed through a live phishing relay, has nothing it can replay ^[35].

But one residual path remains that MFA does not, by itself, close. If an attacker steals a live session token or cookie -- the artifact your browser holds after you have already passed MFA -- then replaying it, in Microsoft's incident-response words, "satisfies the validation of MFA" without any password at all. Adversary-in-the-middle kits such as Evilginx2, paired with pass-the-cookie infostealers, are built to grab exactly that ^[36]. This is why "we turned MFA on" is not the end of the identity conversation. The Snowflake campaign did not involve token replay -- it was plain stolen passwords on accounts with no MFA at all ^[1] -- but the token-replay path is real and adjacent, and it is closed only by binding the session to a known device, not by the MFA prompt alone ^[36]. FIDO2's origin- and device-binding defeats the phishing and relay path; the residual pass-the-cookie risk is closed by device-bound conditional access and prompt token revocation ^{[36, 35]}.

Around that core, eliminate standing long-lived credentials and force rotation after any infostealer exposure; put network or IP allow-lists in front of SaaS admin surfaces; monitor credential-exposure feeds; enforce contractor and bring-your-own-device hygiene; and harden the help desk against social engineering. Coveware found identity-based social engineering to be mainstream by mid-2025, with crews like Scattered Spider and Silent Ransom talking their way past help desks to provision new credentials or MFA devices ^[32]. Technical MFA does not help if an attacker can simply phone your service desk and ask for a reset, so identity-proofing the reset process is part of closing door one.

Door two, the zero-day and third-party vector. Here identity controls do nothing, so the work is attack-surface management and speed. Inventory every internet-facing ERP, managed-file-transfer, and application tier, and stand up emergency patch service levels measured in days -- the Oracle E-Business Suite window from public leak to patch was that short ^[18]. Add egress monitoring and data-loss prevention to catch bulk reads leaving the environment, and minimize and tokenize the data those systems hold so a successful exploit copies out less of value.

Door three, the machine-identity vector. Inventory connected apps and grant them least privilege; prefer short-lived, narrowly scoped tokens over standing grants; keep a revoke-and-rotate playbook ready; and monitor SaaS activity with the platform's own tooling -- the same class of controls Google issued after the Salesforce campaigns, including limiting Data Loader use, managing connected apps, enforcing IP restrictions, and turning on transaction-security monitoring ^{[27, 28]}.

The spine that runs under all three doors is a change in mindset about incidents.

Mapped to the exposure you actually have, the priorities look like this.

Do all of this and you will still not reach zero, because some plaintext has to exist for the business to run, and that residual is the irreducible target. What you will do is make yourself the harder target. In an economy where credentials cost almost nothing and attackers pick the cheapest door that opens, being the harder target is most of the battle.

11. Frequently asked questions#

Every one of these misconceptions dissolves the same way: stop treating encryption as the essence of ransomware, and the paradoxes disappear. Which brings us back to where we started -- the summer 2024 login -- to see it, finally, for what it was.

12. The playbook, rewritten#

Go back to the summer of 2024, to the moment an attacker typed a valid username and password into a Snowflake login page and pressed enter ^[1]. On the first read it looked like an anticlimax -- no exploit, no malware, no encryption, barely a crime scene.

Read it now, with the whole history behind you, and it is the most honest expression of what ransomware had been becoming for thirty-five years. Nothing was locked because locking was never the point. The attacker already had the only thing that mattered: control of the data, and a threat that no backup could answer.

That is the argument this article set out to prove, and the evidence has now accumulated behind it. Encryption was the disposable mechanism; the source of coercion was always the data itself. And in every campaign of the 2024 to 2026 era, the enabling failure was an access-layer failure -- a stolen identity at Snowflake ^[1], or an unauthenticated application zero-day at Oracle E-Business Suite and PeopleSoft ^{[18, 19]} -- and never once a cryptographic break.

The enabling failure was always the access layer -- a stolen identity or an unauthenticated zero-day -- never the cipher. Identity is the real perimeter for the credential-driven campaigns, but the boundary that unifies all of them, identity and zero-day alike, is shared responsibility: the seam between what a provider secures and what a customer must secure for themselves. That seam is where the entire extortion-only era lives.

Hold the two scopes precisely, because the sloppy version of this argument is wrong. "Identity is the perimeter" is true for the credential campaigns and false for the zero-days, which bypass identity entirely; what covers both is the shared-responsibility gap. And "the extortion-only model dominates" is true of tracked extortion cases and false of raw incident counts, where encryption still leads. The careful version of each claim is the one that survives contact with the data.

What remains is the reframed definition the title promised. "Ransomware without the ransom" is not a paradox and not a contradiction. It is ransomware with its most recognizable feature -- the encryption -- finally removed, because that feature was always the removable one. The extortion stayed. The data theft stayed. Only the cipher, the part everyone thought was the essence, turned out to be the accident.

And it leaves defenders with one durable truth, the same one Jim Bates demonstrated in 1990 and BianLian's victims relearned in 2023, now inverted into a limit. A backup restores a file. A seized key restores a network. But there is one loss for which no one has ever built an undo button.

You cannot back up your way out of a leak.