An ordinary working day. An employee turns on her PC. Instead of the usual login screen, a window suddenly appears: "Your databases and backups have been encrypted." She opens the link stored in the text file using the Tor browser, bracing for the chaotic demands of some angry lone hacker.
Instead, a sleek, modern web interface loads. A support widget pops up in the bottom right corner:
Ransomware is no longer the lone hacker in a hoodie. It's a highly specialized shadow economy whose structure rivals that of an established software company.
The real thing: Change Healthcare, February 2024
Just how real this scenario is became clear in the attack on Change Healthcare, the processor behind a third of all US medical claims. On February 12, 2024, the hacking group ALPHV/BlackCat broke in through a single stolen password for a Citrix portal with no multi-factor authentication. The attackers moved through the network unnoticed for nine days, stealing data on roughly 100 million people, then detonated the ransomware on February 21.
The US healthcare system ground to a halt for weeks, and pharmacies and doctors couldn't process billing. The company paid 22 million US dollars in Bitcoin. The extortionists took the money, staged a fake crypto "exit," and sold the stolen data on anyway through the RansomHub group.
The numbers behind it
Change Healthcare isn't an isolated case; it's a symptom of a global trend. The latest figures show just how systematic and profitable this business has become:
| Top 5 groups, 2026 | Top 5 countries, 2026 (victim count) |
|---|---|
| Qilin | USA (2,659) |
| Akira | Germany (360) |
| DragonForce | UK (311) |
| Nightspire | Canada (223) |
| Clop | Italy (207) |
The hardest-hit sectors are manufacturing, professional services, technology, healthcare, and retail & e-commerce, followed by financial services, agriculture, transportation, and government & defense.
From floppy disk trojan to global threat
Ransomware is a type of malware designed as a denial-of-access attack, built to lock access to a system or its data until a specific ransom is paid.
Ransomware has grown from humble beginnings into a worldwide threat that causes billions in damage every year:
Ransomware-as-a-Service (RaaS): extortion as a franchise
RaaS is a cybercriminal business model in which ransomware developers sell their code or malware to other hackers. These so-called "partners" (affiliates) use the code to launch their own attacks. The model pays off for both sides: affiliates profit from extortion without having to build their own malware, while developers grow their profits without ever having to attack a network themselves.
The ransomware kill chain describes the typical phases of an attack, from initial breach to ransom demand:
The ecosystem behind every attack
A ransomware ecosystem is the network of people, services, and infrastructure that supports an attack, from the initial breach of a network all the way to extortion and collecting payment. It includes:
Key roles and concepts in the ransomware supply chain
| Term | Meaning |
|---|---|
| Affiliate | Rents or uses a RaaS platform to carry out attacks, usually paying the operator a percentage of the ransom in return. |
| Initial Access Broker (IAB) | Sells access to compromised networks (VPN, RDP, credentials, web shells) to ransomware groups. |
| Dedicated Leak Site (DLS) | A public dark web platform where stolen data is published to increase pressure during negotiations. |
| Builder | A tool provided by the RaaS operator that lets affiliates create custom ransomware payloads. |
| Panel / Dashboard | A web-based management interface for tracking victims, generating payloads, and handling communication. |
| Cryptor | Obfuscates malicious code to evade security detection. |
| Locker | A ransomware variant that locks system access instead of encrypting files. |
| Stealer logs | Stolen credentials, tokens, and cookies, often used for lateral movement or sold to IABs. |
Customer service: the extortionists' help desk
The victim help desk (usually a 24/7 chat support) walks victims step by step through buying Bitcoin or Monero and restoring their files. Negotiators deliberately apply psychological pressure, offer discounts, set deadlines, and pull additional extortion levers, such as calling the victim company's own customers.
Accounting & money laundering
RaaS works just like a legitimate software-as-a-service business: operators handle development and maintenance, then sell their tools as kits to partners.
| Revenue model | How it works |
|---|---|
| Monthly subscription | A recurring fee (sometimes starting at $40/month) for access to the ransomware tools. |
| One-time fee | Partners buy the ransomware code outright, in a single purchase. |
| Affiliate programs | A monthly fee plus a small percentage of every ransom collected. |
| Profit sharing | No upfront cost, but a substantial cut of the ransom, often 30 to 40%. |
The RaaS panel usually splits incoming ransom payments automatically via crypto mixers, according to the agreed ratio, often 80% affiliate, 20% operator. Specialized finance teams use chain-hopping (e.g., BTC to XMR), mixers, and illicit OTC traders to turn the crypto proceeds into clean fiat currency.
HR & recruiting: extortion's own HR department
Ransomware groups like Conti use structured HR practices to recruit, retain, and motivate staff. Recruiting evolved from vague forum ads into targeted email outreach on platforms like HeadHunter:
Recruiting often proved difficult, since the illegality scared candidates off. A quote from internal research sums it up well: "[...] the hardest part was keeping people once they found out what the job actually involved."
To retain people, the group relied on classic incentives: on-time pay, paid vacation, and real advancement opportunities. The illegality itself was also downplayed during onboarding, for example with new coders:
Legal risk was discussed internally as a concrete danger, especially around foreign travel, such as when a negotiator wanted to fly on vacation without his laptop:
The Conti group shows that ransomware organizations manage their staff with the same tools as legitimate companies: salary, vacation, career paths, and risk communication. Only the product is extortion.
Multi-extortion: how one threat becomes three
A single ransomware attack can now use several pressure points at once to push victims toward paying faster.
Victims often prefer to pay a ransom rather than risk the embarrassment (and possible legal consequences) of a data leak. That calculation is exactly what makes double and triple extortion so effective.
What companies can do against RaaS
Although RaaS has changed the threat landscape, many standard measures for protecting against ransomware remain effective:
- Comprehensive incident response plans: clearly defined procedures for a real emergency, instead of improvising under pressure.
- Anomaly detection tools: solutions like EDR and NDR use AI and machine learning to spot new threats in near real time.
- Reducing the network attack surface: regular vulnerability assessments and consistent patching of commonly exploited flaws.
- Cybersecurity training: employees learn to recognize and avoid phishing, social engineering, and malicious links.
- Access controls: multi-factor authentication, zero-trust architecture, and network segmentation keep ransomware from reaching sensitive data.
- Backup management: regular backups, ideally on devices or drives that can be disconnected from the network.
- Cooperation with law enforcement: often saves both cost and time when containing an attack.
According to the IBM Cost of a Data Breach report, victims who worked with law enforcement were able to cut their breach costs by nearly $1 million on average, not counting the cost of any ransom paid.
An industry you can't afford to underestimate
Ransomware has grown into a highly complex, global shadow economy. Through the Ransomware-as-a-Service model, criminal actors organize themselves like established software companies, with specialized roles ranging from access brokers to affiliates to their own HR and support departments.
At the same time, extortion methods have escalated sharply. Where plain encryption used to be enough, attackers now rely on multi-extortion: system lockout, data publication, and DDoS threats combined. The Change Healthcare incident shows just how vulnerable even critical infrastructure can be, and that paying a ransom is no guarantee of anything.
Technical measures like zero-trust architecture, MFA, and continuous patching need to be paired with organizational incident response plans, offline backups, and preventive staff training. Consistent prevention and close cooperation with law enforcement remain the most effective levers against the lucrative business of RaaS operators.
Is your network infrastructure adequately protected against data exfiltration and ransomware encryption?
We analyze your attack surface and test your defenses under realistic conditions.
REQUEST A CONSULTATION →