Article
What To Do When A Hacker Encrypts Your Data
Combating Ransomware
Cyber Threats
RANSOMWARE, RANSOMWARE...
It’s the boogeyman looming in the corners of every digital task we do. Even businesses that don’t operate primarily online have data points that can be exploited, and hackers are always on the lookout for those with poor cyber health.
[This article originally appeared in Risk & Insurance at:
We Talk About Ransomware All the Time. So What Do We Actually Do When a Hacker Has Our Data? : Risk & Insurance (riskandinsurance.com)]
The cost of an attack is growing, too. As Gallagher reported in its 2022 Cyber Insurance Market Conditions Report, during the first six months of 2021, $590 million were paid in ransom payments, as opposed to $416 million paid in all of 2020.
While we talk about best practices to protect ourselves, how often do we flip the conversation and look at the steps we must take when a hack actually occurs? “Unfortunately, no one is safe from ransomware,” said Evgueni Erchov, head of security research & strategy, Arete.
“The most sophisticated groups can focus on larger organizations … but we also see the small companies being targeted all the time.”
Erchov is an experienced hacker negotiator, with more than 20 years in IT security, application development, cybercrime investigations, computer forensics, cryptocurrency blockchain and cyber threat intelligence analysis.
Erchov, alongside John Farley, managing director, cyber practice, at Gallagher, put on a recent webinar on what to do when a hacker strikes, running through a simulated hack to give businesses recovery tips.
The presentation, “What Really Happens When You Negotiate With a Hacker: An Insider’s View,” illuminated several key points, from how to communicate with hackers, where to gather cryptocurrency if a hacker demands it, and what conversations with underwriters should look like when reviewing cyber controls.
Getting in Touch with Your Hacker
Believe it or not, hacking is a business, and hackers treat what they do as such.
Organized criminals work together to suss out vulnerable targets — from a large corporation all the way down to the neighborhood corner store. If the business has the capability to store data — credit card info, health records, trade secrets, you name it — the business is a viable target.
When a hacker infiltrates a system, the language used in their demand can follow a similar pattern. Hackers will note the data they have access to — employee personal records, partner and client data, financial and accountant documents — and how they intend to gain ransom for encrypting these files.
Next steps will focus on how to communicate with the hacker.
“It depends on how sophisticated the group is,” Erchov said. “Sometimes a ransom note will contain an email address that will be used to go back and forth and negotiate a ransom.”
Money and Extortion: How Demands Lives Have Changed
“In the old days, five or six years ago, we had hackers typically freezing our data, we had extortion, but if you didn’t pay, you just didn’t get your data back,” Farley said.
The scare tactics being used by hackers are changing.
In the simulation during the presentation, the fictive hacker threatens to reveal extremely sensitive data from the company CEO if they don’t receive $1 million in bitcoin within five days. To prove how serious they are, the hacker sends an excerpt of that sensitive info.
Extortion and double extortion are commonplace for hackers these days, Erchov said.
“That really happens quite often, on average, close to 70% of cases nowadays will involve data exfiltration along with the encryption,” he said.
It’s a tactic used to encourage payment, because it not only involves the encryption of sensitive data, but it also hangs corporate reputation in the balance. The ransom becomes more than just retrieving data; it becomes about keeping that data out of public hands.
Bitcoin: How the Heck Do I get My Hands on That?
Once the decision to pay the hackers is made, the next issue is figuring out how to follow through. More hackers are demanding bitcoin payments in their ransoms, but not all companies are working in bitcoin.
So then, what do companies do when their data is held for ransom?
As noted by Farley and Erchov, people believe the first place to go for bitcoin is their cyber insurer. But this is not correct.
“The forensic investigator … the company that deals with forensic investigation and interim response, that’s typically the company that will be handling that,” Erchov said.
However, the cyber insurer can be there to guide the process.
“The beauty of the cyber insurance policy is that you have access to these companies [like a forensic investigation company] that have access to bitcoin and can facilitate the payments,” added Farley.
Forensic investigation companies are often operating on a 24/7 basis as well, and the cyber insurance policy acts as a bridge between client and forensics.
Farley noted these payments are also on reimbursement, so the cyber policy is typically designed to reimburse ransoms after the fact.
The Decision to Negotiate
While paying a hacker immediately to get encrypted data back seems like a no brainer, sometimes negotiating down the ransom is the best line of action, especially if a ransom demand is really large or unfeasible.
But what if low-balling a hacker leads to a bigger data leak?
“They almost expect the initial demand is not going to be paid,” said Erchov.
But it’s important to partner with a negotiator, he said, because the negotiation strategist knows what is a reasonable offer versus what could anger the hacker.
The good news: On average, hackers will negotiate down a ransom by 70%, according to Erchov, based on the cases his company Arete has dealt with in the past.
But that depends on several different factors.
“Potentially, the backups might be available. So in that case, if we only have to negotiate for promise of data deletion, it gives us additional leverage because we don’t need a decryption tool,” Erchov gave as an example.
Questions Your Underwriter Will Ask
“We have a very hard cyber insurance marketplace today,” said Farley. “We’re in a place where ransomware and other factors are really getting the underwriting community very nervous.”
Because of the risk landscape and the size of demand, rates are increasing. Some entities with less cyber controls in place are facing nonrenewal.
So, how can a company make itself a good risk for an underwriter?
“They are going to have a lot of questions for you,” said Farley. He noted his list was not all encompassing, but these are key areas to start.
“Multi-factor authentication. If you don’t have that in place, there’s a chance you might not get underwritten at all,” he said.
Underwriters will also want to see patch management — a written and detailed plan to manage any hacker exploitation. Point detection and response, which is technology used to find a hacker in your system and alert you to them, is another control underwriters like to see.
At the end of the day, the key thing to remember is if your company is on the receiving end of a cyber ransomware event, call your cyber partners immediately.
They will know which resources, from bitcoin, negotiators, forensics and more, will aid in appeasing the hacker and getting your data secured.
Back to Blog Posts
Article
Canvas Platform Compromised by ShinyHunters
In early May, the ShinyHunters threat group claimed responsibility for a large-scale cyberattack on the Canvas learning management platform, affecting almost 9,000 educational institutions worldwide. Instructure, the education technology company that owns Canvas, confirmed the intrusion and, on May 11th, announced that a settlement was reached with the threat actor. According to the statement, the settlement included return of the stolen data to Instructure, assurance of destruction of any copies of the data, and assurance that no Canvas users would be extorted for additional ransom payments.
Unauthorized activity was first detected in Canvas on April 29th and was reportedly the result of cross-site scripting vulnerabilities. Leveraging the same vulnerability, the threat actor conducted a follow-up attack on May 7th, replacing the login screens of Canvas users at hundreds of institutions with a message from ShinyHunters, claiming responsibility for the attack and displaying a list of impacted schools and the threat actor’s contact information.
By May 8th, neither Canvas nor Instructure was posted on ShinyHunter’s data leak site (DLS), and instead a vague “Press Statement” indicated that the group would not comment on the incident. On May 9th, Instructure shared another update, indicating that Canvas was “fully back online and available for use,” along with updates to the company’s FAQ page.
Figure 1. Press statement on ShinyHunters DLS (Source: Arete)
ShinyHunters: Not Just For Pokémon Anymore
ShinyHunters is a predominantly English-speaking cybercriminal group first observed in 2020 that focuses on data exfiltration and extortion. During its early operational phase, the group carried out a series of data breaches targeting organizations, including Tokopedia, Wattpad, and Nitro PDF, establishing a reputation for compromising and monetizing large datasets. Over this period, ShinyHunters remained heavily centered on a “pay or leak” model, leveraging stolen data to pressure victims into ransom payments or selling the information on underground forums when demands were not met.
As the group matured, it evolved beyond opportunistic database theft into a more sophisticated threat actor capable of executing complex, large-scale intrusion campaigns. ShinyHunters has since demonstrated an ability to target higher‑profile industries, including telecommunications, aviation, and enterprise software-as-a-service (SaaS) platforms, by leveraging advanced tactics such as social engineering, SaaS abuse, and supply chain compromise.
The group went as far as to partner with two other threat groups to form the Scattered Lapsus$ Hunters (SLH) collective in early 2025. Playing to each group’s strengths, SLH leveraged compromised OAuth tokens from the Salesloft Drift integration in an advanced supply-chain attack that led to the exfiltration of data across hundreds of Salesforce instances. Despite multiple law enforcement actions and arrests linked to its members, the group has remained operational under the same branding for several years. This persistence highlights the group’s resilience and adaptability, suggesting an operational model that can evolve in response to external pressures.
Analyst Comments
Given the group’s track record, ShinyHunters is likely to continue conducting large-scale data theft and extortion operations while further engraining itself within the broader cybercriminal ecosystem. This recent incident highlights the disproportionate impact of cyberattacks against supply chain vendors like SaaS platforms, open-source ecosystems, MSPs, and cloud integrations, where a breach on one platform can affect thousands of organizations. Any organizations impacted by the recent Canvas incident should not attempt any communication with the threat actor and should continue to follow any future guidance posted on Instructure’s Incident Update & FAQ page.
Sources
Security Incident Update & FAQs
Canvas login portals hacked in mass ShinyHunters extortion campaign
ShinyHunters: A Threat Profile
ShinyHunters
Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal Brand
FBI warns of UNC6040, UNC6395 hackers stealing Salesforce data
Article
Critical MOVEit Automation Vulnerabilities Disclosed
A security advisory released by Progress Software details critical and high-severity vulnerabilities affecting their MOVEit Automation managed file transfer (MFT) solution. The vulnerabilities, tracked as CVE-2026-4670 and CVE-2026-5174, could allow a threat actor to bypass authentication and escalate privileges, leading to unauthorized access, administrative control, and data exposure. Cybercriminals have leveraged several MFT tools in previous campaigns, including the Accellion File Transfer Application (FTA), Fortra GoAnywhere MFT, and Cleo MFT. Flaws in MFT software are highly targeted by cybercriminals due to the volume and sensitivity of the data they control.
What’s Notable and Unique
MOVEit Transfer was heavily exploited by the Cl0p ransomware group in the summer of 2023. While the window of exploit activity lasted only a few weeks, victim extortion and data leaks continued throughout the remainder of the year, leading to more than 70 class-action lawsuits filed in the U.S.
There is no workaround or hotfix for these vulnerabilities. To fully patch the flaws, MOVEit administrators need to perform a "full install" of the latest version, which will require taking the system offline.
Security researchers have discovered ~1,400 MOVEit Automation instances exposed to the internet, with dozens belonging to U.S. local and state government agencies.
Analyst Comments
While the vulnerabilities patched in Progress Software's recent release differ from the SQL injection vulnerability exploited by the Cl0p ransomware group in 2023, exploitation of CVE-2026-4670 and CVE-2026-5174 could lead to equally impactful outcomes. Beyond the immediate impacts on affected organizations, trusted data-exchange platforms provide threat actors with an avenue to obtain sensitive information and infect partner and supplier environments. Furthermore, Arete has seen the time window between disclosure and weaponization of critical vulnerabilities continue to shrink, especially as threat actors increasingly adopt AI-enabled tooling. As such, organizations should not only implement the patches released by Progress Software, but also hunt for typical post-compromise behavior like enumeration of the underlying database, the creation of new user accounts or users operating with unexpected administrator privileges, and the presence of unauthorized remote monitoring and management (RMM) tools.
Sources
MOVEit Automation Critical Security Alert Bulletin – April 2026 – (CVE-2026-4670, CVE-2026-5174)
From Breach to Courtroom: Inside the MOVEit Exploitation and Mass Litigation
Progress warns of critical MOVEit Automation auth bypass flaw
Article
Ransomware Trends & Data Insights: April 2026
The threat landscape has remained relatively predictable thus far in 2026. In April, Qilin dethroned Akira as the most active threat group for the month. Akira, who had been the top ransomware threat each month since July 2025, was still only slightly behind Qilin and had roughly the same activity level as in March. INC Ransom and DragonForce also remained active threats in April, with those four ransomware groups accounting for half of all ransomware and extortion activity observed by Arete.
Figure 1. Activity from the top 3 threat groups in April 2026
Throughout the month, analysts at Arete identified several trends behind the threat actors perpetrating cybercrime activities:
Multiple ransomware operations continue to leverage the Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint security controls prior to ransomware deployment. Qilin has recently been observed leveraging a malicious file loaded via DLL side-loading along with vulnerable drivers, including rwdrv.sys and hlpdrv.sys, to gain kernel-level access and disable security processes. Arete observed Akira using the same vulnerable drivers in multiple engagements dating back to Q3 2025.
DragonForce has leveraged several of the same tools in recent engagements, including the remote desktop application Remotely Agent and the PoisonX.sys vulnerable driver. Additionally, open-source reporting indicates that the group recently used a Python-based backdoor known as VIPERTUNNEL to maintain reliable operator access and evade detection. DragonForce was responsible for over 7% of Arete ransomware engagements in April, and Arete notes increased activity from the group this year compared to 2025.
A social engineering tactic has reemerged in recent months in which threat actors impersonate IT and helpdesk staff via Microsoft Teams to contact employees and attempt to convince them to install remote access tools like Quick Assist, giving the threat actors remote access to the victim’s environment. This tactic was initially observed in late 2024 and early 2025 and was linked to now-defunct groups like Black Basta and Cactus, but has more recently been observed in intrusions linked to the Akira and Payouts King ransomware groups.
Sources
Arete Internal
Article
Payouts King Utilizes QEMU Emulator to Bypass EDR
Researchers recently identified threat actor campaigns leveraging QEMU, a free open-source virtual machine (VM) emulator, to evade endpoint security solutions. Since QEMU acts as a VM within the target environment, endpoint detection tools cannot scan inside the emulator or detect any malicious files or payloads QEMU contains. Although threat actors have been utilizing QEMU maliciously since 2020, recent activity is attributed to the Payouts King ransomware group and a cluster of threat actors believed to be initial access brokers who have also been exploiting the CitrixBleed2 vulnerability CVE-2025-5777.
What’s Notable and Unique
Payouts King has been observed deploying QEMU since November and uses the VM to create a reverse SSH backdoor to evade detection and install various tools, including Rclone, Chisel, and BusyBox.
In a separate campaign, threat actors are exploiting CVE-2025-5777, a Citrix NetScaler vulnerability that allows attackers to bypass authentication. Once they’ve gained initial access, the threat actors use QEMU to deploy tools inside the VM, which are then used to steal credentials, identify Kerberos usernames, perform Active Directory reconnaissance, and set up FTP servers for staging or data exfiltration.
Analyst Comments
Threat actors continue to focus their efforts on defense evasion, often leveraging legitimate, easily accessible tools such as QEMU. The continued use of QEMU by multiple threat actors highlights the effectiveness of these tactics and the difficulty in detecting and defending against them. To counter this campaign, organizations should proactively monitor for unauthorized QEMU installations, abnormal scheduled tasks, and port forwarding rules.
Sources
QEMU abused to evade detection and enable ransomware delivery