As 2025 concludes, the cyber extortion landscape has bifurcated into two (2) main strategies: volume-driven Ransomware-as-a-Service (RaaS) campaigns targeting mid-market companies and high-cost, targeted intrusions aimed at larger enterprises. The Akira RaaS group exemplifies the former, exploiting vulnerabilities to execute numerous attacks with low demands but high ransom payment rates. This model focuses on maximizing attack volume regardless of victim size, thus maintaining market share. Conversely, some groups focus on high-value targets, though this is costly and yields lower payment rates. Larger enterprises become targets when extortion campaigns exploit widely used software or hardware, as seen in CLoP and Scattered Spider’s activities. In Q3, ransomware groups expanded into enterprise environments with targeted methods. Insider threats are emerging, such as the Medusa ransomware gang’s attempt to bribe a BBC employee for network access. This marks a shift from typical data-theft events to more direct ransomware deployment through insider collaboration. Ransomware economics have evolved from low-cost operations to more complex RaaS models that include data theft. As profits thin and trust between developers and affiliates erode, some groups abandon ransomware for data-theft-only strategies. This shift, coupled with declining ransom payment rates, reflects a contracting cyber extortion economy. In Q3 2025, the average ransom payment dropped significantly, with large enterprises resisting pressure to pay. Mid-market attacks, while more frequent, resulted in lower payments. Ransom payment rates fell to a record low of 23%, highlighting collective progress in defense strategies. Common attack vectors remain remote access compromise, phishing, and software vulnerability exploitation. Exfiltration, lateral movement, and command-and-control tactics dominate, with discovery activities providing early detection opportunities. Ransomware attacks remain opportunistic, exploiting accessible entry points rather than specific industries. The median company size rose to 362 employees, challenging assumptions that larger targets guarantee larger payouts. As the landscape evolves, organizations must enhance insider threat programs and adapt to new extortion tactics. CTIX analysts remain committed to providing the latest updates to threat actor activity and emerging threats.