The RaaS economy

Try it out loud first. Then check yourself:

1. Ransomware-as-a-Service splits roles: developers build the locker and leak site, affiliates run intrusions
2. Affiliates typically keep 70-90% of ransom; initial access brokers sell footholds to affiliates
3. Big names: LockBit, BlackCat/ALPHV, Conti (leaked 2022), Cl0p; takedowns like Operation Cronos in 2024
4. Affiliates move between brands, so tracking affiliate TTPs beats tracking ransomware family names
5. Payment pressure: leak sites, DDoS, contacting customers; sanctions (OFAC) complicate paying

If the interviewer pushes back

• Did the LockBit and ALPHV disruptions reduce total ransomware activity or just redistribute it?

Go deeper

• www.cisa.gov/stopransomware