[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fB0BV6vdh6RqB3bpHbGdBpH1NS48fTCSHlhd25ENVTdU":3},{"article":4,"iocs":37,"watch_terms":41},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"718f32e0-b43b-427e-9868-827bcd2995d7","Less Lucrative Ransomware Market Makes Attackers Alter Methods","less-lucrative-ransomware-market-makes-attackers-alter-methods","Ransomware actors are ditching Cobalt Strike in favor of native Windows tools, as payment rates hit record lows and data theft surges.","Ransomware actors are shifting tactics away from Cobalt Strike toward native Windows tools as the market becomes less profitable, with payment rates declining to record lows while data theft extortion tactics gain prominence. This strategic pivot reflects economic pressures on threat actors and their adaptation to evolving detection capabilities that flag commercial tools like Cobalt Strike.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fthreat-intelligence\u002Fless-lucrative-ransomware-market-makes-attackers-alter-methods","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblte72d0bf351c7e0d2\u002F69b9b4c0a7730701b4a14225\u002Ffarmer_Yuri_Arcurs_Alamy.jpg?width=1280&auto=webp&quality=80&disable=upscale","2026-03-17T21:41:12+00:00","2026-03-17T23:00:15.658787+00:00",8,[],"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":17,"icon":10,"name":19,"slug":20},"Ransomware","ransomware",[22,27,32],{"category":23},{"id":24,"icon":10,"name":25,"slug":26},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":28},{"id":29,"icon":10,"name":30,"slug":31},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":33},{"id":34,"icon":10,"name":35,"slug":36},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[38],{"type":26,"value":39,"context":40},"Cobalt Strike","Commercial penetration testing tool increasingly abandoned by ransomware operators in favor of native Windows utilities",[]]