Ransomware-as-a-service, explained like the business it is

The phrase “ransomware gang” conjures a single group of hackers attacking companies end-to-end. That model died years ago. Modern ransomware is a supply chain of specialist businesses, and the one whose name ends up in the headlines often did the least work. Here’s the org chart.

The franchise model

The core crew (the “brand”) builds and maintains the ransomware itself, runs the leak site, handles negotiations infrastructure, and takes a cut — typically 10–30% — of every ransom. LockBit, Qilin, Akira: these are brands and platforms, not armies.

Affiliates are independent operators who “license” the ransomware, do the actual intrusions, and keep 70–90% of the take. A skilled affiliate may work for several brands at once, or switch brands overnight when one gets taken down. This is the single most important fact in ransomware tracking: the people and the brand name are loosely coupled.

Initial access brokers (IABs) sell the way in — a VPN credential, a webshell, a compromised remote-desktop box — on criminal markets for anywhere from $100 to tens of thousands, priced on the victim’s size. Affiliates buy access wholesale and work through it like a sales pipeline.

Supporting services fill in the rest: crypters, bulletproof hosting, negotiation specialists, money laundering. It’s a full economy with customer support and, occasionally, PR statements.

Why this structure matters to defenders

1. Takedowns rarely kill the threat — they rebrand it. When law enforcement seizes a brand’s infrastructure, the affiliates (the actual intrusion talent) migrate to other brands or launch new ones within weeks. We track 270+ named crews in our graph, and the churn is constant: brands die, operators persist. This is why serious trackers maintain “same-as” links between crew identities — yesterday’s Hive affiliates are today’s somebody-else.

2. The attack on you involves multiple independent actors. The IAB who phished your contractor in March, the affiliate who bought that access in May, and the brand whose ransom note you read in June are usually three different businesses. Each handoff is a delay — and that delay is your detection window. Median dwell times mean the access being sold predates the ransomware by weeks. Finding the foothold before the handoff beats any amount of post-encryption response.

3. Tooling and technique follow the brand. Because affiliates deploy the brand’s playbook, government advisories about a crew — the CISA #StopRansomware series is the gold standard — give you concrete, citable technique and CVE lists worth defending against. That’s threat intelligence you can actually action, with a receipt.

The economics, briefly

A mid-size ransom of $400k splits roughly: brand takes ~$80k, affiliate ~$320k, from which the affiliate paid maybe $2k for access and some infrastructure costs. Margins like that explain everything else you observe: the professionalisation, the recruitment, the resilience to takedowns, and why claims volume keeps running at over a thousand victims a month across the ecosystem.

It also explains the one piece of good news: these are businesses, so they respond to costs. Every control that makes you more expensive to monetise — offline backups, segmented networks, rehearsed refusal — pushes the affiliate toward the next victim in the pile. You don’t have to outrun the bear.

One honest caveat

Everything anyone publishes about crew structure comes from leak-site behaviour, law-enforcement documents, and the crews’ own statements — criminals describing themselves. The franchise model above is well-evidenced in prosecutions and leaks (the Conti leaks remain the best open-source look inside), but specific revenue splits and crew sizes are always estimates.

Go deeper

Per-crew dossiers — claimed victims, sectors, suspected origin, activity trend — live in our ransomware tracker, with open data feeds. Related: how gangs pick victims and what a leak site actually is.