--- title: New Ransomware Strains Have Researchers On Their Toes description: New Ransomware Strains Have Researchers On Their Toes --- [Securafy Knowledge Hub](https://blog.securafy.com) - [Topics](https://blog.securafy.com/#sf-cover) - [Tools](https://blog.securafy.com/#sf-tools) - [Books & Guides](https://blog.securafy.com/#sf-books) [Talk to Securafy](https://meetings.hubspot.com/securafy/strategy-call) [Topics](https://blog.securafy.com/#sf-cover) [Tools](https://blog.securafy.com/#sf-tools) [Books & Guides](https://blog.securafy.com/#sf-books) [Talk to Securafy](https://meetings.hubspot.com/securafy/strategy-call) [Knowledge Hub](https://blog.securafy.com) / IT Operations IT Operations # New Ransomware Strains Have Researchers On Their Toes New Ransomware Strains Have Researchers On Their Toes ![Randy Hall](https://blog.securafy.com/hubfs/Randy%20Hall%202.png) By Randy Hall Updated Nov 2025 3 min read Share [**](https://www.linkedin.com/sharing/share-offsite/?url=https://blog.securafy.com/2021/03/26/new-ransomware-strains-have-researchers-on-their-toes) [**](https://twitter.com/intent/tweet?url=https://blog.securafy.com/2021/03/26/new-ransomware-strains-have-researchers-on-their-toes&text=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3ENew+Ransomware+Strains+Have+Researchers+On+Their+Toes%3C%2Fspan%3E) [**](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3ENew+Ransomware+Strains+Have+Researchers+On+Their+Toes%3C%2Fspan%3E&body=https://blog.securafy.com/2021/03/26/new-ransomware-strains-have-researchers-on-their-toes) ![](https://static.hsstatic.net/BlogImporterAssetsUI/ex/missing-image.png)Recently, researchers have discovered two new ransomware strains, dubbed "AlumniLocker" and "Humble", both of which have very different ways of doing what they do. This highlights the ongoing development and diversification of the larger ransomware threat and underscores the fact that it will be a major cause for concern in the years ahead. Both new strains were discovered by researchers at Trend Micro. In the case of AlumniLocker, it seems to be a new variant of the Thanos ransomware. Although new to the game, is notable for its exorbitant ransom demands, as high as $450,000, payable in Bitcoin, in one recent successful attack. **AlumniLocker** This one is delivered along fairly conventional means, via a malicious PDF that purports to be an invoice and delivered via phishing emails, hoping to lure unsuspecting victims into opening the file. As is increasingly the case in the world of ransomware attacks, AlumniLockers controllers threaten to publish stolen data if their demands are not met within 48 hours of the attack. There are two competing theories about the high ransom demands: One is that the group behind the new strain isn't in it for the money as much as they are the damage that publication of the data may cause. If they get a payout, great. If it proves too high, causing some companies to balk, then they get to inflict pain in the form of publication of sensitive and proprietary data. Another theory is that the group is just starting out and still finding their footing. As such, they haven't yet found the "sweet spot." A payment demand low enough to be readily accepted by a desperate company but high enough to earn them consistent, easy profits. **Humble ** This one is quite different. Although it is distributed in much the same way, their ransom demands are quite low; stunningly low in fact, in some cases as little as $10, again, payable in Bitcoin. This has led researchers to conclude that Humble is meant to target end users, rather than large organizations, or, if the hackers shift gears and begin targeting organization, we should expect to see the amount of the ransom increase quite a bit. Another feature that makes Humble stand out is that they pressure victims into paying by threatening to rewrite their Master Boot Record, rendering the machine entirely unusable. Also of interest, it utilizes Discord (a voice, text and video service) to send reports back to its controllers. If you have yet to encounter either of these new threats, stay tuned. It's probably just a matter of time, so stay on your guard. Tagged Under IT Operations[Cybersecurity](https://blog.securafy.com/tag/cybersecurity)Business ContinuityAI Governance In This Article Need Help With Your Current Setup? Talk through your current systems, risks, and support gaps with Securafy. [Book a Strategy Call](https://meetings.hubspot.com/securafy/strategy-call) ## Join The Conversation Have a question or perspective on this topic? Add it below. ![Randy Hall](https://blog.securafy.com/hubfs/Randy%20Hall%202.png) About The Author Randy Hall · CEO & Founder Randy Hall is the CEO and Founder of Securafy, with decades of experience helping organizations make smarter, safer decisions about technology. A frequent speaker and instructor at national IT events, Randy has advised thousands of organizations, from startups and SMBs to large enterprises and U.S. government entities, on secure, practical technology adoption. He writes about the decisions business leaders are often expected to make without enough context, including cybersecurity, compliance, AI, cyber insurance, IT strategy, and business resilience. Outside the office, you’ll often find Randy on Lake Erie enjoying time on his 38-foot Chris-Craft. **Writes about:** Cybersecurity strategy, compliance, AI security, business resilience, cyber insurance, SMB risk, IT leadership [More From This Author →](https://blog.securafy.com/author/randyhall) Related Articles Business Continuity [Compliance Risk Assessment: How Downtime Impacts Your Bottom Line](https://blog.securafy.com/compliance-risk-assessment-how-downtime-impacts-your-bottom-line) When systems go down, compliance obligations don't pause—and the financial consequences ... Jul 28, 2026 Compliance [HIPAA Security Rule Changes Are Delayed To 2027: Why Healthcare Organizations Should Not Wait](https://blog.securafy.com/hipaa-security-rule-changes-are-delayed-to-2027-why-healthcare-organizations-should-not-wait) The updated HIPAA Security Rule won't take effect until 2027, but healthcare ... Jul 23, 2026 Compliance [Multi Factor Authentication Best Practices for CJIS Security Policy Compliance](https://blog.securafy.com/multi-factor-authentication-best-practices-for-cjis-security-policy-compliance) Law enforcement agencies and criminal justice organizations face mounting pressure to ... Jul 16, 2026 Compliance [CMMC Phase II Has Been Suspended: What Defense Contractors Still Need To Do](https://blog.securafy.com/cmmc-phase-ii-has-been-suspended-what-defense-contractors-still-need-to-do) The Department of Defense suspended CMMC Phase II enforcement, but that doesn't mean ... Jul 15, 2026 IT Operations [Cybersecurity For Veterinary Clinics: Protecting Client Data, Payment Systems, And Practice Operations](https://blog.securafy.com/cybersecurity-for-veterinary-clinics-protecting-client-data-payment-systems-and-practice-operations) Veterinary clinics handle sensitive client data, payment information, and critical ... Jul 9, 2026 IT Operations [AT&T Cybersecurity, AlienVault USM, And Managed Security: What SMBs Still Need To Own](https://blog.securafy.com/att-cybersecurity-alienvault-usm-and-managed-security-what-smbs-still-need-to-own) Managed security platforms like AT&T Cybersecurity and AlienVault USM provide ... Jul 8, 2026 Get Practical Cybersecurity Field Notes Monthly cybersecurity, compliance, and IT strategy updates from Securafy, written for business owners who need clear next steps. - Practical security tips from our Cyber Security Drip series - The Securafy Times, our monthly roundup on compliance and IT strategy - Occasional updates on new tools, guides, and research - No spam — unsubscribe anytime NIST CSF 2.0 Zero Trust Application Control CISA Aligned Enterprise Partner © 2026 Securafy — Columbus & Cleveland, Ohio [Main Site](https://www.securafy.com/) [Blog Home](https://blog.securafy.com/) [Contact](https://www.securafy.com/contact.html) [Privacy Policy](https://www.securafy.com/privacy-policy.html) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Randy Hall", "url" : "https://blog.securafy.com/author/randyhall" }, "dateModified" : "2025-11-04T18:54:00.340Z", "datePublished" : "2021-03-26T15:00:00.000Z", "headline" : "New Ransomware Strains Have Researchers On Their Toes", "mainEntityOfPage" : { "@id" : "https://blog.securafy.com/2021/03/26/new-ransomware-strains-have-researchers-on-their-toes", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.securafy.com/hubfs/securafy-logo.png" }, "name" : "Securafy Inc." } } ``` ```json { "@context" : "https://schema.org", "@id" : "https://securafy.com/#organization", "@type" : "Organization", "address" : [ { "@type" : "PostalAddress", "addressLocality" : "Columbus", "addressRegion" : "OH", "postalCode" : "43219", "streetAddress" : "4449 Easton Way, Suite 200" }, { "@type" : "PostalAddress", "addressLocality" : "Independence", "addressRegion" : "OH", "postalCode" : "44131", "streetAddress" : "6100 Oak Tree Blvd, Suite 200" } ], "areaServed" : [ "Columbus OH", "Cleveland OH", "Ohio" ], "name" : "Securafy Inc.", "url" : "https://securafy.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://securafy.com/#website", "@type" : "WebSite", "inLanguage" : "en-US", "name" : "Securafy", "publisher" : { "@id" : "https://securafy.com/#organization" }, "url" : "https://securafy.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.securafy.com/#blog", "@type" : "Blog", "name" : "Securafy Knowledge Hub", "publisher" : { "@id" : "https://securafy.com/#organization" }, "url" : "https://blog.securafy.com" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.securafy.com/2021/03/26/new-ransomware-strains-have-researchers-on-their-toes#article", "@type" : "Article", "author" : { "@id" : "https://www.securafy.com/about-us/#randyhall", "@type" : "Person", "name" : "Randy Hall" }, "dateModified" : "2025-11-04T18:54:00+00:00", "datePublished" : "2021-03-26T15:00:00+00:00", "description" : "New Ransomware Strains Have Researchers On Their Toes", "headline" : "New Ransomware Strains Have Researchers On Their Toes", "image" : "https://www.securafy.com/hs-fs/hubfs/securafy-og-default.jpg", "inLanguage" : "en-US", "isPartOf" : { "@id" : "https://blog.securafy.com/#blog" }, "mainEntityOfPage" : { "@id" : "https://blog.securafy.com/2021/03/26/new-ransomware-strains-have-researchers-on-their-toes", "@type" : "WebPage" }, "publisher" : { "@id" : "https://securafy.com/#organization" }, "url" : "https://blog.securafy.com/2021/03/26/new-ransomware-strains-have-researchers-on-their-toes" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://blog.securafy.com", "name" : "Knowledge Hub", "position" : 1 }, { "@type" : "ListItem", "item" : "https://blog.securafy.com/2021/03/26/new-ransomware-strains-have-researchers-on-their-toes", "name" : "New Ransomware Strains Have Researchers On Their Toes", "position" : 2 } ] } ```