Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape

This Mandiant report analyzes the ransomware threat landscape and observed TTPs from 2025 incident response engagements.

• •In a third of incidents, initial access was confirmed or suspected via vulnerability exploitation in VPNs and firewalls
• •77% of ransomware intrusions involved suspected data theft, up from 57% in 2024
• •43% of intrusions targeted virtualization infrastructure, up from 29% in 2024
• •REDBIKE was the most frequently deployed ransomware family, accounting for 30% of incidents
• •Ransom payment rates hit a historic low in Q4 2025, with average demands dropping to $1.34M from $2M in 2024
• •Threat actors are shifting focus toward smaller organizations and data-theft-only extortion operations