Eeny, Meeny, Miny, Moe? How Ransomware Operators Choose Victims
Sophos, Wednesday, January 28th, 2026
Most ransomware attacks are opportunistic, not targeted at a specific sector or region
Counter Threat Unit (CTU) researchers are frequently asked about ransomware groups posing a threat to organizations in specific verticals or geographic locations. These questions usually follow the publication of third-party reports that highlight how a particular ransomware group is 'targeting' a specific sector.