There is seemingly very little information available about the emergence of ransomware; doxware.
I could only find a couple of news articles suggesting that doxware encrypts your files, but also copies them over to the attacker.
Current (server side) anti ransomware software kicks off a client when it detects that a lot of filenames are being changed. This will prevent your files from being encrypted but doesn't protect your files from being copied over to an attacker.
I read that Doxware variants have so far only been used in targeted attacks. However, it's very easy to integrate Doxware in automated malware. I'm actually surprised that there haven't been very large and automated attacks yet.
How do you defend against doxware (except from training your users not to click on rogue emails)?