INTEL128 · RESEARCH · October 14, 2026
How ransomware groups choose their victims
Ransomware is usually reported as a list of names: a company, a group, a date. But the claim feed, read as a whole, shows the decision-making underneath the list. This article lays out three patterns we observe in how groups choose and pressure their victims, and what they imply for anyone trying to stay off the next one.
The claim feed is the observable behavior
A ransomware group publishes a claim for a reason. The claim is an advertisement to other victims and a message to the current one. The choice of *when* to publish, *which files* to advertise, and *who* to name is deliberate - which means it can be read.
We treat every claim as a data point: the victim, the sector, the geography, the group, the date, and the advertised file tree. In aggregate, those points stop looking like noise.
Pattern one: sector targeting is seasonal, not random
Groups do not choose victims uniformly. Certain sectors recur in waves. When a group finds a working playbook against one kind of target - a product, a supplier, a type of database - it tends to run that playbook until the returns drop.
- A group that compromises one logistics provider often lists another within weeks, because the same entry point exists at the second.
- A group that extracts a payroll system at one company has a template ready for the next company running the same system.
The implication is uncomfortable: your exposure is not just your own. It is shared with every other organisation that looks like you.
Pattern two: re-shipping is the pressure tactic
When a victim does not pay, the group re-publishes the claim - sometimes with more files, sometimes with a countdown, sometimes against a different subdomain. We track these re-ships as their own signal.
A re-ship means the negotiation is not going the way the group wants. It also means the group is re-engaging with the victim's data at that moment. For a defender, the re-ship is the point at which the claim stops being a headline and becomes an active, dated event on a timeline.
Pattern three: the file tree is the negotiation
The advertised file tree is not a neutral inventory. It is curated. Groups lead with the files that hurt most: customer data over internal memos, legal documents over marketing assets.
What a group chooses to advertise tells you what it thinks the victim values. The same breach, advertised differently, is a different negotiation - which is why we treat file-tree metadata as intelligence, not as a list of filenames.
What this means for defenders
None of these patterns requires access to a dark web forum. They are visible in the public claim record.
- Know your lookalikes. The sectors and suppliers around you are the best predictor of your own exposure.
- Watch the re-ship. A claim against a peer that moves to a second round is your early warning, not theirs.
- Treat the file tree as strategy. What a group advertises is what it believes will make a victim pay - and that is a map of what you should protect first.
The full claim record we study is published as it lands on the Threat watch wire. This article is the layer on top of that record: the patterns, not just the list.
INTEL128 RESEARCH. Independent analysis published by the Intel128 lab. Findings describe publicly recorded activity; they are not an endorsement of any vendor and not a prediction of any specific event.