The Problem: Recovery Doesn’t Stop Disclosure
Ransom payment rates have fallen to record lows — somewhere in the twenties depending on the dataset — while published victim counts climbed to 7,551 in the twelve months to March 2026, up nearly 25% and a fourth consecutive record. Those two numbers together explain more about the current threat landscape than either does alone.
When fewer victims paid for decryption keys, attackers adjusted their business model. Stealing data before encrypting it — or skipping encryption entirely and just taking the data — provides leverage that backups cannot address. A firm with excellent recovery capability can restore operations in a day and still face the harder conversation: what was taken, who needs to be notified, and what the regulatory obligations are.
The article makes the point plainly: recovery solves downtime, not disclosure. Most incident response plans handle the operational track well and the disclosure track poorly, because the logging that answers “what left your environment” has to exist beforehand. Exfiltration is quiet, often spread over days, and frequently uses legitimate cloud storage services so the traffic looks ordinary.
How FileSure Stops It at Two Points
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file operations before they complete. It addresses this threat at the earliest and most durable intervention points.
First: block the payload from landing. Ransomware and data theft malware have to write an executable payload to disk before they can run. FileSure intercepts that write operation. A rule blocking unauthorized programs from writing executable files to the system drive stops the attack before it starts — the payload never lands, so encryption and exfiltration never happen. This works on zero-day malware the same way it works on known threats, because the control is behavioral rather than signature-based.
Second: detect and block exfiltration attempts. If something does bypass your other defenses and begins operating, FileSure detects the file operations that exfiltration requires: mass file reads by unauthorized programs, bulk file copies to USB drives or network shares, file access by browser processes attempting to upload via webmail. You can configure rules to alert on these patterns or block them outright.
A specific example configuration for a healthcare organization concerned about patient record theft:
- File type filter: *.docx, *.xlsx, *.pdf (common formats for sensitive records)
- Folder location: C:\PatientRecords\
- Blocked operations: Read by any program except authorized EMR software; Copy to USB or removable media
- Alert conditions: More than 50 files accessed within one hour by a single user
- Action: Block and generate immediate alert to IT
This gives you two things the article identifies as missing from most incident plans: you know what was accessed (complete audit trail of every file operation with user, program, timestamp, and machine), and you can prevent it from leaving (block the copy or upload operation at the kernel level before it completes).
The Logging You Need Before the Incident
The article makes a critical operational point: determining what data left your environment is a separate investigation from restoring it, and the logging that answers it has to exist beforehand. Windows Event Log auditing is insufficient for this — it generates massive volumes, causes log rollover, and provides limited detail on file-level operations.
FileSure records every file operation in a tamper-resistant, searchable log: who accessed what, when, with which program, and from which machine. For organizations with notification obligations under HIPAA, PCI DSS, or state breach laws, this is the difference between notifying based on what you can prove was accessed versus notifying based on the worst reasonable case.
The proportionate version for smaller organizations: log it for the systems holding the data you would have to notify about, rather than for everything. FileSure’s per-workstation licensing model makes this economically feasible.
Test It Yourself
Install FileSure on a test machine, configure a rule blocking executable writes from your email client, and send yourself an email with a harmless test file. Watch the write get blocked and logged. That’s the upstream intervention — the attack prevented before it starts.
Then open a Word document and check the log. You’ll see the file access recorded with your username, the program name, and the timestamp. That’s the audit trail the article says you need before the incident happens.
Start your free 21-day trial at bystorm.com — 1 server, 10 workstations, fully functional.
Source: Fewer Firms Pay Ransoms, So Attackers Changed the Pressure
Category: Ransomware
Tags: ransomware, data exfiltration, double extortion, kernel filter driver, file system security, data loss prevention, backup recovery
