FinCEN Ransomware Report: $2.1B in Payments Over Three Years

What FinCEN Reported

On December 4, 2025, the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) published a Financial Trend Analysis of ransomware incidents. The analysis covers incidents that appeared in Bank Secrecy Act (BSA) data from 2022 through 2024. Over that three-year window, ransomware payments in the filings totaled more than $2.1 billion. 1

That figure is the headline number, and it is a large one. FinCEN's announcement frames the analysis around what financial institutions reported through the BSA system. 1 It is not an estimate of every ransom paid worldwide. The distinction matters for reading the number correctly. The $2.1 billion reflects payments that touched U.S. reporting obligations and were captured in those filings. It is best treated as a documented floor rather than a ceiling for what ransomware extracted during the period.

Why Financial Data Matters

Most public reporting on ransomware comes from security vendors and incident responders. Those firms describe how attackers break in, which tools they use, and which sectors they hit. FinCEN's vantage point is different. It sees money moving, as reported by banks and other institutions required to file under the BSA. 1

That gives regulators and law enforcement a view of ransomware as a financial crime and not only a technical one. Ransom payments have to travel through the financial system at some point, whether during the initial transfer or when criminals try to cash out. A three-year analysis of that activity can, in principle, show where payments flow and how large they are. It can also suggest where intervention could be most effective. The announcement's emphasis on the multi-year total suggests Treasury wants the scale of the problem to register with institutions and policymakers alike. 1

The Threat Picture Keeps Shifting

Payment data is necessarily backward-looking. It records what victims paid after attacks already happened. Meanwhile, the attacks themselves continue to evolve, and recent reporting shows how quickly the tactics move.

One example is the actor known as Warlock, which is also tracked as Gold Salem, Longlegs, and Storm-2603. Warlock rose to prominence in mid-2025 when it exploited the zero-day "ToolShell" vulnerabilities in Microsoft SharePoint to deploy ransomware. 2 Reporting dated October 2026 says the suspected China-linked group was still using SharePoint flaws, likely both old and new ones. In those attacks it disabled security tools before deploying ransomware. 2 The Symantec and Carbon Black Threat Hunter Team observed this activity against critical infrastructure, government, and education organizations in Portuguese- and Spanish-speaking countries. 2

A second case points in a different and arguably more troubling direction. A threat actor called JADEPUFFER, which Microsoft tracks as Storm-3168, carried out destructive operations inside a Microsoft Azure environment in early June 2026. 2 The attackers used compromised service principals to go after a wide range of cloud resources over about 18 hours. Those resources included storage accounts, SQL databases, Key Vaults, Function Apps, virtual machines, App Services, and recovery protection locks. 2 Microsoft researchers described the activity as an evolution of the group's tradecraft. 2

Reading the Two Together

The FinCEN analysis and the threat reporting look at different stages of the same problem. They also cover different time periods. FinCEN's figures run through 2024. 1 The Warlock and JADEPUFFER activity described above comes from 2025 and 2026. 2 Nothing in the reporting ties those specific groups to the payments in FinCEN's dataset, and they should not be read as linked.

The combination still says something useful. The financial data confirms that ransomware has been a multibillion-dollar enterprise in recent years. The incident reporting shows attackers adapting in ways that could change both how much victims pay and whether paying is even an option.

The JADEPUFFER case stands out in particular. The attackers targeted recovery protection locks and core cloud services. 2 When attackers go after an organization's ability to recover, the pressure on victims increases. This kind of destructive activity also weakens the assumption that a payment buys restoration. Warlock's practice of disabling security tools before deploying ransomware points to a similar goal: attackers are working to remove defenders' options before the extortion phase begins. 2

The Takeaway

In this analysis, FinCEN's $2.1 billion figure works best as a benchmark rather than a verdict. It documents what the financial system saw during a defined period. 1 The more recent threat activity suggests that period is already giving way to a more aggressive phase. Attackers are exploiting widely used enterprise software and compromising cloud identities to cause damage at scale. 2

For financial institutions, the FinCEN analysis reinforces the value of reporting under the BSA. For everyone else, the lesson is that the dollar totals will trail the tactics. Defenses built around last year's payment patterns are unlikely to be enough against next year's intrusions.