ransomware-ecosystem

Ransomware Ecosystem

Executive Summary

The ransomware ecosystem operates predominantly through a Ransomware-as-a-Service (RaaS) model, where operator groups develop and maintain ransomware payloads, negotiate with victims, and manage leak sites, while affiliates — independent contractors — handle the actual intrusion, lateral movement, and deployment. This division of labor has driven the industrialization of ransomware since roughly 2019, enabling groups to scale operations far beyond what a single team could achieve. Revenue sharing typically follows a 70/30 or 80/20 split favoring the affiliate, though elite affiliates can negotiate better terms. The double-extortion model (encrypting data AND threatening to leak it) is now standard, with some groups pursuing triple extortion by adding DDoS threats or contacting victims' customers directly.

Law enforcement has achieved significant disruptions in 2023-2025, including the takedown of Hive (January 2023), the disruption of LockBit infrastructure in Operation Cronos (February 2024), the ALPHV/BlackCat exit scam following the Change Healthcare payment, and sustained pressure on Cl0p. However, the ecosystem demonstrates remarkable resilience: displaced affiliates migrate to new platforms, operators rebrand, and new RaaS programs emerge to fill gaps. The total ransomware economy is estimated at over $1 billion annually in direct payments, with substantially higher costs when accounting for downtime, remediation, and reputational damage.

The current landscape as of early 2026 features a more fragmented ecosystem following the disruptions of the major groups. RansomHub emerged as a significant player absorbing former LockBit and ALPHV affiliates. Akira, Play, and Black Basta continue active operations. Smaller, more agile groups proliferate, potentially making the ecosystem harder to disrupt through single-point takedowns. Healthcare, education, manufacturing, and critical infrastructure remain heavily targeted sectors.