Key Takeaways

  • Virtual Routes added 24 entries, including 20 developments from July through September 2026.
  • Falling payment rates are pushing ransomware operators toward fewer, higher-value targets and more fragmented business models.
  • Enforcement, blockchain tracing, governance, and coordinated incident response are becoming more closely connected.

Virtual Routes has expanded its Ransomware Countermeasures Tracker with 24 additional entries, adding a fresh set of developments for security leaders following the changing response to extortion campaigns. Twenty of the entries cover activity from July through September 2026, giving enterprises a more current view of enforcement, policy, financial tracing, and operational countermeasures.

The update arrives as the ransomware economy sends mixed signals. Payments are declining, but attacks are not. Accountability is improving, yet the criminal ecosystem is splintering into smaller brands, affiliates, access brokers, infrastructure suppliers, and laundering services that can be difficult to investigate as a single operation.

According to Chainalysis, ransomware actors received about $820 million in on-chain payments during 2025, an 8% decline from the previous year, even as claimed victim numbers increased 50%. Only 28% of victims paid in 2025, compared with 62.8% in 2024. At the same time, the median payment rose 368% to $59,556.

That combination matters. Lower payment rates can weaken the broad economics of ransomware, while larger median payments suggest operators are concentrating pressure on organizations perceived as more able, or more likely, to pay. For corporate security teams, a falling aggregate payment total should not be confused with a falling operational risk.

Ransomware is no longer adequately described as simply a malware problem. Initial access can be purchased, infrastructure rented, data stolen by one participant, negotiations managed by another, and proceeds moved through several financial channels. Chainalysis identified at least $14 million in 2025 payments to initial-access brokers, illustrating how monetization can begin well before encryption or an extortion demand appears.

What does meaningful disruption look like in that environment? Increasingly, it means targeting the supporting system rather than waiting for a recognizable ransomware brand to surface.

Europol provided one prominent example through Operation Endgame. In its November 2025 phase, the cross-border effort disrupted more than 1,025 servers, involved searches at 11 locations, and produced an arrest. The operation focused on infrastructure that enabled ransomware and other cybercrime, showing how investigators can create impact by removing shared technical resources.

The FBI and other national agencies also play a role, but the underlying lesson is broader: cybercrime investigations increasingly depend on rapid cooperation among law enforcement, hosting providers, cryptocurrency services, intelligence specialists, and affected businesses. A server seizure in one jurisdiction may be less valuable if related accounts, domains, wallets, or administrators remain active elsewhere.

Blockchain evidence is becoming part of that coordination. Transaction records can help investigators connect ransom payments to access brokers, affiliates, exchanges, and laundering networks. The Financial Action Task Force risk-based standards for virtual assets and virtual-asset service providers provide a policy foundation for customer due diligence, suspicious-transaction reporting, and international cooperation around illicit crypto flows.

For enterprises, this tracker update can serve as more than a catalog of takedowns. It can help boards and security teams assess whether their own plans reflect the changing structure of the threat. The NIST Cybersecurity Framework 2.0 offers a useful reference, particularly through its Govern and Respond functions. Governance clarifies authority, risk ownership, and reporting expectations. Response planning addresses containment, communications, analysis, mitigation, and recovery.

That said, a framework alone does not settle difficult decisions. Enterprises still benefit from rehearsing who can isolate systems, engage law enforcement, preserve wallet and negotiation evidence, contact insurers, and approve public disclosures. Tabletop exercises can also expose delays between technical teams, legal counsel, executives, and third parties.

Virtual Routes’ 24 new tracker entries reflect a counter-ransomware strategy that is becoming wider and more connected. Payment resistance is one part. Infrastructure disruption, financial intelligence, international enforcement, and stronger corporate preparation are others. The pressure on ransomware operators is real, but fragmentation means defenders will likely need to track the services surrounding each campaign, not only the name displayed on a ransom note.