What is a ransomware campaign?

A ransomware campaign is a coordinated series of attacks run by a threat group or its affiliates, often targeting a specific industry, region, or vulnerability using shared tooling and techniques. Campaigns are typically tracked by the malware family and the tactics, techniques, and procedures the operators reuse.

Understanding the campaign behind an incident helps responders anticipate behavior such as data exfiltration and backup tampering. Elastio maps findings to known families and surfaces forensic artifacts to support that analysis.

Last updated May 27, 2026