The Evolution of Ransomware: From Simple Encryption to Multi-Extortion Attacks

Ransomware attacks have evolved from simple file encryption schemes to sophisticated multi-extortion campaigns that can cripple entire industries. The University of Mississippi Medical Center's recent experience illustrates the devastating real-world impact of these attacks. When ransomware struck in February 2026, it took the Epic electronic health record system offline across 35 clinics and more than 200 telehealth sites. The consequences were immediate and severe: chemotherapy appointments were canceled, non-emergency surgeries postponed, and medical staff forced to revert to paper-based workflows. Countless patients bore the brunt of these disruptions.

The healthcare sector's vulnerability is particularly alarming. Recent data shows that 93% of U.S. healthcare organizations experienced at least one cyberattack in 2025, with 72% reporting that incidents directly disrupted patient care. But hospitals aren't alone in facing this threat. The manufacturing and financial sectors are equally exposed. In the same month as the UMMC attack, payment processing network BridgePay suffered a ransomware attack that completely took down its APIs, virtual terminals, and payment pages.

The numbers tell a stark story: publicly disclosed ransomware attacks surged 49% year-over-year in 2025, reaching 1,174 confirmed incidents. As hospitals halt treatments, financial institutions freeze transactions, and manufacturers shut down production lines, ransomware has firmly established itself as a direct business risk with tangible operational consequences.

The Evolution: From Single to Multi-Extortion

Early ransomware operated on a straightforward premise: infiltrate a system, encrypt files, and demand payment for the decryption key. This model worked until organizations began countering it by restoring from backups rather than paying ransoms. Threat actors responded by developing a more lucrative approach—double extortion.

In a double extortion attack, adversaries first exfiltrate sensitive files—such as patient records and billing data—before encrypting the target system. Victims face pressure on two fronts: pay to receive the decryption key, or risk public exposure of stolen data. This evolution made backups alone insufficient as a defense strategy. Since attackers already possess the data, refusing to pay can result in the public release of sensitive files, exposing organizations to significant business losses and regulatory consequences.

The threat landscape continues to escalate. Triple extortion cases are on the rise, where attackers directly contact a victim organization's customers or partners to apply additional pressure. As of 2025, 124 active ransomware groups have been identified, with 73 newly emerged. The proliferation of AI-powered tools has lowered the barrier to entry for cybercrime, making ransomware capabilities increasingly accessible to less sophisticated actors.

Rethinking Defense Strategies

The rise of multi-extortion ransomware fundamentally changes the assumptions underlying traditional defense strategies. Perimeter-based prevention alone is no longer sufficient. Organizations need a security posture that protects data from being weaponized after a breach—rendering exfiltrated data unreadable, blocking ransomware from accessing files in the first place, and enabling rapid recovery even when an attack succeeds.

D.AMO: A Comprehensive Defense Architecture

D.AMO, developed by Penta Security, represents an encryption-based data protection platform designed to address every phase of a multi-extortion ransomware attack. It delivers integrated encryption, access control, and backup recovery across on-premises and cloud environments.

By applying file encryption and process-based access control technologies, D.AMO protects critical data stored on servers and PCs—safeguarding sensitive information against malicious programs through robust access enforcement.

Key Capabilities

Folder-Level File Encryption

D.AMO KE encrypts all files within administrator-designated folders at the OS level. Deployable via an installer without source code modification, it operates using kernel-level encryption technology, enabling fast and secure encryption on existing systems with no disruption to the user experience. Encryption policies are applied at the folder level, ensuring consistent protection with minimal operational overhead.

Critically, even if an attacker exfiltrates sensitive data, the files remain encrypted—neutralizing the data exposure threat that is central to double extortion.

Access Control

D.AMO KE enforces strict access control over processes and OS users, permitting only explicitly authorized access. Ransomware and other malicious applications are automatically blocked from accessing encrypted folders, preventing unauthorized file manipulation. All blocked activity is recorded through an audit log function and can be reviewed centrally via D.AMO Control Center.

Backup and Recovery

Even in the event of a successful attack, organizations can resume operations through an independently managed recovery system. With D.AMO in place, the ability to restore from backup significantly reduces dependence on decryption key negotiations with threat actors.

As multi-extortion tactics become the norm, neutralizing the data attackers seek to exploit has become a strategic priority. Organizations need the ability to render exfiltrated data unreadable, prevent ransomware from accessing files, and recover rapidly when incidents occur. D.AMO addresses each stage of a ransomware attack within a single integrated platform—combining encryption, process-based access control, and backup recovery into a unified line of defense.

The evolution of ransomware from simple encryption to multi-extortion attacks represents a fundamental shift in the cybersecurity landscape. Organizations can no longer rely on traditional perimeter defenses or backup strategies alone. The new reality demands comprehensive protection that renders stolen data useless to attackers, blocks malicious access at the file level, and enables rapid recovery when breaches occur. As ransomware groups continue to innovate and AI lowers barriers to entry, adopting defense-in-depth strategies like D.AMO becomes not just advisable but essential for business continuity and data protection.