Most ransomware defenses rest on a simple assumption: if files look encrypted, you’ve been hit, and if they look normal, you’re safe. New research suggests that assumption is outdated. After detonating 1,064 real ransomware strains in a controlled environment during the first half of 2026, Index Engines’ CyberSense Research Lab found that directory-entry destruction (47.8%) was far more common than full encryption (18.3%). Some strains even scrambled data while leaving filenames, file sizes, timestamps, and …