Less Lucrative Ransomware Market Makes Attackers Alter Methods

Ransomware actors are shifting tactics away from Cobalt Strike toward native Windows tools as the market becomes less profitable, with payment rates declining to record lows while data theft extortion tactics gain prominence. This strategic pivot reflects economic pressures on threat actors and their adaptation to evolving detection capabilities that flag commercial tools like Cobalt Strike.