The Emergence of the Insomnia Ransomware

Insomnia is a newly identified cyber threat operation that surfaced around October 2025, initially appearing as a ransomware-related threat actor, but quickly distinguishing itself through a fundamentally different approach. Unlike traditional ransomware groups, Insomnia does not rely on file encryption or the use of a ransomware file extension. Instead, it focuses exclusively on large-scale data exfiltration and extortion.

The group has rapidly gained attention due to its targeted campaigns against healthcare-related organizations, particularly in the United States. With at least 18 publicly claimed victims—more than half of which are tied to hospitals, clinics, and healthcare service providers—Insomnia represents a clear shift in cybercriminal strategy: from operational disruption to pure data theft and exposure.

Information on “Insomnia”

How Insomnia Operates

Insomnia represents a modern evolution of cyber extortion tactics, prioritizing stealth and persistence over disruption. Instead of deploying ransomware payloads, the group gains access through compromised credentials—often harvested via infostealer malware or authentication bypass vulnerabilities.

Once inside a network, attackers maintain a prolonged dwell time—often averaging around 60–70 days—during which they silently explore systems, identify high-value data, and prepare for exfiltration. This “low-and-slow” approach allows them to evade traditional detection mechanisms.

Lateral movement is conducted using legitimate administrative tools such as Windows Server processes, enabling attackers to blend into normal system activity. Sensitive data—including patient records, legal documents, tax files, and personal identification—is then staged and exfiltrated. Finally, the group publishes or threatens to publish the stolen data on its leak site, applying pressure without ever encrypting systems.

Why Insomnia Is Different from Traditional Ransomware

Insomnia highlights a critical shift in the cyber threat landscape. Traditional ransomware relies on encrypting systems and demanding payment for decryption. Insomnia bypasses this entirely, focusing on irreversible damage through data exposure.

This approach renders many conventional defenses ineffective:

• Backups and disaster recovery cannot restore stolen data or protect privacy once exposed
• Firewalls and endpoint detection systems fail to identify attackers using valid credentials
• There is no encryption event to trigger alerts—only normal-looking activity
• Extortion leverage is based on reputational and regulatory damage rather than downtime

Additional Information

• Insomnia primarily targets small to mid-sized healthcare organizations with limited cybersecurity resources.
• Victims often include clinics, nursing facilities, dialysis centers, and medical malpractice law firms.
• The group appears to use a hybrid model, potentially acting as both an intrusion operator and a broker for stolen data.
• Stolen datasets frequently include highly sensitive personal and medical information, increasing regulatory and legal risks.
• The operation demonstrates a strong geographic bias toward U.S.-based organizations, with occasional international victims.
• There is currently no confirmed ransomware encryptor associated with Insomnia, reinforcing its classification as a data theft operation.
• Attackers may avoid targeting certain regions, suggesting alignment with established cybercriminal “safe harbor” patterns.

Conclusion

Insomnia represents a significant evolution in cyber extortion tactics, shifting away from traditional ransomware toward pure data theft and exposure. This model eliminates reliance on encryption and instead exploits weaknesses in identity, access control, and data governance. For organizations—especially in healthcare—the implications are severe: once sensitive data is exfiltrated, the damage cannot be undone.

To defend against threats like Insomnia, organizations must move beyond perimeter-based security and adopt data-centric protection strategies, including strong authentication, access control, monitoring, and secure data handling practices.

As specialists in cybersecurity and incident response, we provide essential services such as Ransomware Recovery Services, Ransomware Negotiation Services, and our Incident Response Retainer. Contact us today to protect your organization against evolving cyber threats.

Last updated on: March 19, 2026