Ransomware Leverage is Growing by the Terabyte: Takeaways from ThreatLabz 2026 Ransomware Report | Zscaler
Ransomware groups shifted leverage to terabyte-scale data theft, targeting business users via Teams vishing and legitimate remote support tools like Quick Assist. Top 10 ransomware groups exfiltrated 896.2 TB, a 275.8% year-over-year increase. Attackers target manager-level employees through spam bombing combined with Microsoft Teams vishing, then pivot to Quick Assist for remote access. Average ransom payment rose 5.3% to $431,995 despite total payment volume declining.
Detection / Hunteropenrouter
Immediate Actions
- Restrict Quick Assist and remote support tools to authorized admin profiles only
- Block external Microsoft Teams messaging from unverified tenants
- Enable DLP alerts for large outbound data transfers to cloud storage
- Review Teams audit logs for recent external sender vishing patterns
Key Takeaways
- 896.2 TB exfiltrated by top 10 groups, up 275.8% year over year
- 62% of victims held manager-level titles or above
- 75% of victims worked in finance, sales, operations, HR, or marketing
- 52 newly active ransomware groups identified over the last year
- 7,366 victims listed on leak sites, down only 3% year over year
Attack Chain
- Initial Access: Spam bombing combined with Microsoft Teams vishing targets business users
- Execution: Attacker steers victim to Quick Assist or remote support utility for hands-on access
- Discovery: Attacker conducts internal reconnaissance to identify high-value data and systems
- Lateral Movement: Attacker moves across network using legitimate credentials and tools
- Exfiltration: Attacker steals terabyte-scale data to maximize extortion pressure
- Impact: Ransom demanded with threat of public data leak
Affected Systems
- Microsoft Teams
- Windows Quick Assist
- Enterprise collaboration platforms
- Remote support utilities
- Windows endpoints
- SaaS applications storing business data
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Quick Assist and Teams are legitimate tools; EDR may not flag their use by default. |
| Network Visibility | Medium | Large-scale exfiltration over HTTPS or cloud services may blend with normal traffic. |
| Detection Difficulty | Hard | Attackers abuse trusted tools and legitimate workflows, making behavioral detection challenging. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Quick Assist or remote support sessions initiated shortly after unusual Teams messaging activity from external or unverified senders (T1219, T1566). | Teams message logs and Quick Assist process events | Initial Access | Medium — legitimate IT support uses these tools |
| Large outbound data transfers to cloud storage services from endpoints with active remote support sessions (T1567, T1005). | Proxy egress logs and DLP alerts | Exfiltration | Low — volume thresholds reduce false positives |
| Manager-level or business-role accounts exhibiting lateral movement patterns or accessing systems outside their normal scope (T1021, T1078). | IAM logs and EDR authentication events | Lateral Movement | Medium — business users may access varied systems |
Required Log Sources
- Microsoft Teams audit logs
- Windows Quick Assist process logs
- EDR process telemetry
- Proxy or firewall egress logs
- DLP event logs
- Identity and access management logs
Key Behavioral Indicators
- Quick Assist process launched by non-IT user context
- Teams messages from external senders followed by remote support tool execution
- Bulk data archive creation on endpoints with active remote sessions
- Unusual outbound HTTPS volume from single endpoint to cloud storage
- Manager-level accounts accessing systems outside normal access patterns
- Spam bombing pattern preceding remote support session initiation
Control Gaps
- No monitoring on Quick Assist session initiation or duration
- Teams external messaging not restricted or logged for vishing indicators
- DLP not tuned for terabyte-scale outbound transfers
- No behavioral baselines for business-role user access patterns
- Remote support tool execution not restricted to authorized admin profiles
False Positive Assessment
Medium — Quick Assist and Teams are legitimate enterprise tools used daily by IT and business staff; behavioral thresholds must account for normal support workflows.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Implement zero trust segmentation to limit lateral movement from compromised endpoints
- Enforce tenant restrictions on Microsoft Teams and collaboration platforms
- Deploy inline TLS/SSL inspection for outbound traffic to cloud storage services
- Configure SaaS security posture management to monitor unauthorized data transfers
User Protection
- Train manager-level and business-role employees on Teams vishing and social engineering
- Require MFA for all remote support tool sessions
- Deploy browser isolation for external web interactions by high-risk users
- Disable Quick Assist on endpoints where it is not operationally required
Security Awareness
- Educate non-IT staff that attackers impersonate IT support via Teams and Quick Assist
- Establish a verified internal process for remote support requests that bypasses Teams
- Warn finance, HR, and operations teams about spam bombing preceding vishing attempts
MITRE ATT&CK Mapping
Initial Access
Execution
Persistence
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Plain-Language Summary
Ransomware attackers are stealing record amounts of data, nearly 900 terabytes across the top groups, to pressure victims into paying. They target managers and business staff rather than IT admins, tricking them through fake support calls on Microsoft Teams and legitimate remote-help tools like Quick Assist. Organizations should restrict remote support tools, monitor for unusual data transfers, and train non-technical staff on social engineering.