Ransomware is growing more sophisticated, targeting supply chains and backup systems. Zentrova's cybersecurity experts analyse the trends and recommend six priority measures.
Ransomware remains the number one threat to businesses in 2026. Incidents handled by Zentrova's Security Operations Centre in the first half of the year show that attackers are changing tactics quickly, leaving traditional defences no longer sufficient on their own. Below we summarise what we are seeing and the steps we recommend every organisation take now.
Four trends to watch
1. Multi-layered extortion
Attackers no longer just encrypt data. They also steal it, threaten to publish customer information and even contact the victim's partners directly to increase pressure.
2. Supply chain attacks
Rather than targeting large enterprises head-on, attackers get in through software suppliers, maintenance contractors or remote management tools with broad access rights.
3. Going after backups
Many attacks begin by locating and deleting backups before the ransomware is triggered, leaving the victim with no way to recover. In several cases, backup consoles had been left without multi-factor authentication.
4. AI-assisted attacks
AI-written phishing emails are increasingly natural and hard to spot, including in Vietnamese. The time between initial intrusion and data encryption has shrunk to a matter of hours.
Six priority measures
- Multi-factor authentication on every admin account, remote access channel and mailbox.
- 3-2-1 backups, with at least one immutable or offline copy.
- Network segmentation to limit how far an infection can spread from a single compromised machine.
- Disciplined patch management, prioritising edge devices and internet-facing systems.
- Continuous monitoring with endpoint detection and response, backed by a 24/7 security operations centre.
- Regular incident response drills, including full system restores from backup.
No business can stop every attack, but every business can decide how quickly it will recover.
Don't forget the human factor
More than 70% of the incidents we handle start with a click on a phishing email or a leaked password. Ongoing security awareness training, combined with simulated phishing exercises, remains one of the most cost-effective investments an organisation can make. Clear reporting channels matter too: employees should know exactly whom to call the moment something looks wrong, without fear of blame.
Zentrova's Cybersecurity division offers ransomware readiness assessments, penetration testing and 24/7 security monitoring aligned with ISO/IEC 27001:2022. Contact info@xxxxx.vn to speak with our team.
