The Evolution of Ransomware: From Floppy Disks to Industrialized Extortion

What this piece does

Almost every explanation of ransomware is organised around a single moment — the AIDS Trojan, or WannaCry, or Colonial Pipeline — and treats everything else as prologue or aftermath. That framing misses the actual mechanism of the threat, which is accumulation. Ransomware has never really replaced its old techniques with new ones. It has kept every form of leverage it ever invented and bolted the next one on top.

This piece traces that accumulation across five eras, from a 1989 scam mailed on floppy disks to today's franchised extortion economy. It then steps out of chronology to answer three questions a chronology alone does not: how to actually classify a ransomware operation (there are three independent axes, and a single group sits on all of them); how the major criminal brands are related to each other by code, personnel, and rebranding; and — because FlagThis readers ask this specifically — where the operators communicate, whose infrastructure carries that traffic, and which public resources let a defender watch the ecosystem operate without ever opening a Tor browser.

Two things about how to read it. First, where a claim rests on a single vendor's assessment or an inference rather than a primary source, the text says so — the underground is unusually well-documented (court filings, sanctions designations, several enormous self-inflicted data leaks), but attribution between rebrands is still probabilistic, and the family-tree diagram in particular draws clean lines over links that range from confirmed to merely plausible. Second, almost every "victim count" and "most active group" figure in ransomware reporting — including the trackers this piece recommends — is compiled from attacker claims on leak sites, which are routinely padded with re-posts, recycled old breaches, and organisations that were never actually compromised. Where numbers appear here, treat them as an upper bound on activity, not a measured one.

Five eras, each built on the last

The through-line is that each era's defining capability became permanent. Asymmetric encryption did not go away when data theft arrived; data-leak sites did not go away when groups added DDoS. A defender facing a 2026 intrusion is facing all five eras at once.

Era 1: locked screens and mailed cheques (1989–2012)

The first piece of extortion malware was the AIDS Information Trojan, also called PC Cyborg, written by the Harvard-trained biologist Joseph Popp and distributed in December 1989 on roughly 20,000 floppy disks mailed to attendees of a World Health Organization AIDS conference. After the 90th boot it used symmetric encryption to scramble file names (not contents) on the C: drive and set them hidden, rendering the disk unusable, then demanded $189 sent to a post-office box in Panama. Because the key was symmetric and embedded in the program itself, researchers extracted it and published free recovery tools (Jim Bates' AIDSOUT/CLEARAID). The economic model — physical distribution, postal payment, trivially reversible crypto — made it a curiosity rather than a template.

The commercial threat that emerged two decades later was the screen locker. Families like WinLock (2010) and the widely franchised Reveton (2012) mostly skipped file encryption entirely. They seized the Windows shell or abused registry run-keys to display a full-screen notice, localised by geography, claiming to come from the FBI, Interpol, or a national police force and accusing the victim of possessing illegal material. Payment ran through anonymous prepaid vouchers — Ukash, Paysafecard — which required the victim to physically buy a code at a shop and which the operators then had to launder through resellers. That friction, plus the fact that a locker could often be removed with a bootable rescue disk, capped the model.

Era 2: asymmetric crypto meets cryptocurrency (2013–2018)

CryptoLocker, which appeared in September 2013 and was distributed by the GameOver Zeus botnet, combined three things that every serious ransomware family has used since. It encrypted files with a hybrid scheme — a per-file symmetric AES key, itself wrapped with an RSA public key whose private half never touched the victim's machine. It generated and stored those keys on command-and-control infrastructure. And it took payment in Bitcoin, a borderless, irreversible settlement network that made automated "pay this address, get your key" workflows possible for the first time. A 2014 multinational operation (Tovar) disrupted the botnet and a security firm later published a key database, but the design had already propagated.

What followed was volume. Locky, Cerber, TeslaCrypt, and CryptoWall rode massive email spam campaigns and exploit kits, encrypting home users and small businesses at scale for a few hundred dollars each. Two 2016–2017 developments pointed toward the future. The original Petya (2016) abandoned file-by-file encryption and instead overwrote the Master Boot Record and encrypted the NTFS Master File Table, taking the whole disk hostage at once — and it was already sold as a service: a group calling itself Janus Cybercrime Solutions ran a Petya/Mischa affiliate panel with per-affiliate ransom pricing and a cut of every payment, so the RaaS model that later groups made famous was in the wild by 2016. And in 2017 two self-propagating worms weaponised EternalBlue (MS17-010), an SMB exploit leaked from the NSA:

• WannaCry (May 2017) spread to more than 200,000 machines across 150+ countries in days. The US and UK governments attributed it to the North Korea–linked Lazarus group. Its kill-switch domain and broken payment handling suggest it was released before it was finished.
• NotPetya (June 2017) was delivered through a compromised update to the Ukrainian accounting package M.E.Doc and then spread laterally using EternalBlue and credential theft. It presented a ransom note but its encryption was irreversible by design — a wiper dressed as ransomware. It has been attributed to Russia's GRU (Sandworm, Unit 74455) and caused damage estimated above $10 billion, most of it outside Ukraine.

NotPetya is the clearest early example of a pattern that recurs throughout this history: the ransomware form — the note, the countdown, the payment address — is a wrapper that can be placed around espionage, sabotage, or pure theft.

Era 3: big game hunting begins (2018–2019)

By 2018 the arithmetic of mass-market ransomware had gone soft. Consumer endpoints were better patched, backups were more common, and the yield per infection was falling. The response was to add a new tier on top: fewer targets, chosen deliberately, each worth far more. This did not replace the low end — high-volume commodity ransomware aimed at small businesses (Dharma, Phobos and their many descendants) is still, by number of incidents, a large share of the total. What changed is that the money and the headlines moved to the deliberate, hands-on-keyboard intrusions.

SamSam (2018) manually broke into hospitals, universities, and municipalities through exposed RDP and unpatched JBoss servers, then spread ransomware across the whole network before demanding tens of thousands of dollars. The US indicted two Iranian nationals over it in November 2018. Ryuk, first seen in August 2018, took the same idea further, using the TrickBot botnet (often via an Emotet → TrickBot chain) as a delivery mechanism into large enterprises and demanding six- and seven-figure sums. Ryuk's code was adapted from Hermes, sold on forums in 2017 by a group calling itself CryptoTech; the earliest Ryuk activity was attributed variously to CryptoTech and — because Hermes had also featured in a Lazarus bank heist — briefly to North Korea, before CrowdStrike consolidated it under the Russian-speaking operator it tracks as Wizard Spider (initially as a sub-group, "Grim Spider") in 2019.

Where the big-game crews came from is one of the largest continuities in the story: the Russian-speaking operations that came to dominate the space largely inherited their supply chain from the banking-trojan underground. The operators, the loader botnets, the bulletproof hosting, and the laundering and mule networks that had spent a decade stealing from bank accounts (Zeus, Dridex, Dyre) moved into ransomware between roughly 2017 and 2019, because the margins were better. Wizard Spider is assessed to include ex-Dyre personnel; Evil Corp grew directly out of Dridex (see Family trees below). Not every crew fits this — SamSam's operators and the later English-speaking groups came from elsewhere — but the dominant lineages do.

This is also the period that produced the term Big Game Hunting (coined by CrowdStrike) and the role that makes it work: the Initial Access Broker (IAB), a specialist who compromises a corporate perimeter, does light reconnaissance to gauge the victim's size, and sells that foothold — VPN credentials, a web shell, RDP access — as a product on a criminal forum. The intrusion and the extortion were now separable jobs.

Era 4: double extortion and the RaaS franchise (2019–2021)

Two structural changes landed almost together and define the modern threat.

The data-leak site. In November 2019 the operators of Maze ransomware, having attacked the staffing firm Allied Universal, did something new when the victim did not pay: they published a chunk of the stolen files and told journalists where to find them. Within weeks Maze had a dedicated "news" site listing non-paying victims with samples of their data and a countdown. This is the hinge of the whole history. Encryption attacks a victim's availability, which good backups restore. Publishing stolen data attacks confidentiality, which nothing restores. Within a year almost every serious group ran a leak site. The payoff for defenders took longer to show up but is now unambiguous: the share of victims who pay fell from about 85% in Q1 2019 to roughly three-quarters through 2020, and then — as backups, incident-response maturity, and legal pressure compounded — to a record low, put at 25% for Q4 2024 by Coveware and 28% for full-year 2025 by Chainalysis, even as the reasons to pay multiplied. On-chain ransom revenue tracks the same way: a ~$1.25 billion peak in 2023, ~$892 million in 2024, ~$820 million in 2025. What has risen instead is the median observed payment — up 368% to about $59,600 in 2025 (Chainalysis) — as groups abandon the small end and chase the few victims who will pay large.

Maze also demonstrated the churn pattern early. It announced its own shutdown in November 2020; its affiliates and playbook had already moved to Egregor (and, in part, Sekhmet), and Egregor in turn collapsed after arrests in Ukraine in February 2021. The brand died; the people and the technique did not.

Ransomware-as-a-Service. The franchising model — a core team maintains the malware, the panel, and the negotiation infrastructure while vetted "affiliates" do the break-ins for the large majority of each ransom — was not new (Janus's Petya panel ran it in 2016; GandCrab made it prolific from 2018, claiming $2 billion before a staged "retirement" in mid-2019). But 2020–2021 is when it became the dominant structure for serious operators. Conti, REvil, DarkSide, Egregor, DoppelPaymer, and Ryuk's successors all ran affiliate programs, recruited on Russian-language forums, and competed openly on profit split and tooling quality.

The era's political turning point was Colonial Pipeline (May 2021). A DarkSide affiliate compromised Colonial's IT and billing systems — not the operational technology that runs the pipeline — but Colonial shut the pipeline down itself as a precaution, and the resulting fuel disruption on the US East Coast lasted about a week. The blowback was severe enough that within days the two principal Russian-language cybercrime forums, XSS (13 May 2021) and Exploit (a day later), banned all ransomware advertising, affiliate recruitment, and discussion. Access brokers could still sell corporate footholds; they just had to stop saying the word "ransomware." Two months later the ban created its own workaround: in July 2021 the former Babuk leak-site domain (payload.bin) was rebranded into RAMP ("Ransom Anon Market Place"), explicitly as the one forum where ransomware business was still allowed. RAMP was founded by an operator using the handle Orange. Whether "Orange" is Mikhail Matveev (wazawaka) is contested — Matveev, who has given press interviews and was indicted and sanctioned by the US in 2023, has at times claimed the identity and at times distanced himself from it, and analysts do not fully agree. What is firm is the US action against Matveev himself and his documented ties to multiple ransomware operations; the RAMP-founder equivalence is a weaker, disputed claim.

Era 5: multi-extortion, hypervisors, and churn (2022–present)

The current era is defined less by a single new capability than by several simultaneous pressures.

Extortion kept laddering. Beyond encrypt-and-leak, groups now routinely add a third and fourth layer: DDoS against the victim's public services during negotiation (seen from SunCrypt and RagnarLocker as early as 2020, and ALPHV in 2021), call-centre and email harassment of executives and customers, and — in a 2023 escalation by ALPHV — filing a complaint with the US SEC about a victim's failure to disclose the breach on time.

Encryption became optional. Cl0p demonstrated the endpoint of the trend and has kept demonstrating it. In 2023 it mass-exploited zero-days in two managed-file-transfer products — Fortra's GoAnywhere MFT (CVE-2023-0669) in January, then Progress MOVEit Transfer (CVE-2023-34362) in May–June — stealing data from an estimated 2,700+ organisations without deploying a locker at all. It repeated the pattern against Cleo file-transfer software in late 2024, and again in 2025 against Oracle E-Business Suite: exploiting CVE-2025-61882 as a zero-day from around August 2025, months before Oracle's emergency patch on 4 October, then emailing extortion demands to dozens of large organisations (Harvard and the University of Pennsylvania among the confirmed victims). The MFT, then the ERP: the target is any product that concentrates a lot of other companies' data behind one internet-facing service. There is nothing to decrypt; the entire leverage is the threat to publish.

Hypervisors became first-class targets (and an EDR blind spot). Because enterprise estates run on a small number of virtualization hosts, a locker that runs natively on VMware ESXi or Microsoft Hyper-V can encrypt hundreds of guest VMs at once by targeting the underlying .vmdk / .vhdx files — and it does so below the endpoint agents running inside each guest. More crucially for attackers, VMware ESXi's stripped-down POSIX VMkernel does not support third-party kernel EDR agents. Reversing ESXi payloads (from Babuk variants to Akira and LockBit Linux) reveals a standardized execution flow: scripts invoke vim-cmd vmsvc/getallvms and vim-cmd vmsvc/power.off (or esxcli vm process kill) to unmount and power down virtual machines, terminate administrative daemons (hostd, vpxa) to blind management logging, and then traverse /vmfs/volumes/ to encrypt disk images directly via POSIX file descriptors. The leaked Babuk builder (see below) put working ESXi-locker code in the hands of dozens of crews.

The encryptor got faster, quieter, and moved to Rust. From 2022 most serious families adopted intermittent (partial) encryption — configuring mathematical stride modes (such as header-only, header-and-footer, or percentage-based strides like 10%, 20%, or 50% intervals). This not only cuts a locker's on-disk time from hours to minutes; it directly defeats heuristic file-entropy scanners (Shannon entropy), because the unencrypted blocks preserve the file's natural statistical byte distribution below AV tripwires. Ciphers shifted from RSA-plus-AES to an elliptic-curve key exchange (Curve25519) combined with a high-speed stream cipher (ChaCha20 or Salsa20). Tooling diversified into modern compiled languages: Rust (ALPHV in 2021, followed by Akira v2 and Qilin) offers zero garbage-collection overhead, multi-platform compilation, and complex mangled symbol tables that challenge decompilers, while Go (Knight, early BianLian) provides rapid cross-platform builds at the cost of bloated binaries.

One defender-relevant pattern persists through all this: rushed crypto is repeatedly breakable due to fundamental implementation flaws: - Keystream reuse (Hive): Hive generated an in-memory ~100MB matrix of keystream bytes and derived file-encryption keys by taking sliding offsets into that matrix. Because corporate files contain predictable headers and null blocks, researchers executed known-plaintext attacks to mathematically reconstruct the master matrix and decrypt files without paying. - Insecure PRNG state seeding (Akira): Early C++ builds of Akira generated their ChaCha20 symmetric keys and nonces using a weak pseudo-random number generator seeded with predictable thread identifiers and timestamp values, collapsing the key search space and enabling Avast to ship a free decryptor. - Key retention and config bugs: DarkSide, BlackMatter, and several Babuk forks have shipped flaws in key-encapsulation footers or mistakenly failed to securely zero session keys from process heap memory before termination, leaving key material recoverable from RAM dumps.

The resulting free decryptors are mostly for older variants, not the group currently on your network — but nomoreransom.org and a competent IR firm both check, and it costs nothing to look before paying.

The anti-EDR arms race and execution pipeline. As endpoint detection and response (EDR) displaced signature antivirus around 2019–2021, intrusion tradecraft moved to defeating it directly. Operators rarely drop unencrypted, naked PE binaries on disk; payloads are delivered via custom loaders (e.g. Donut shellcode), DLL side-loading alongside signed third-party executables, and in-memory reflective injection. Payloads bypass userland EDR API hooks in ntdll.dll using indirect syscalls (Hell's Gate / Tartarus' Gate) to execute kernel transitions (ZwWriteVirtualMemory, ZwCreateThreadEx) undetected.

On disk, lockers actively resolve file-locking conflicts: modern enterprise lockers (LockBit 3.0, Conti, Royal/BlackSuit) invoke the Windows Restart Manager API (RstrtMgr.dll — RmStartSession, RmRegisterResources, RmShutdown), programmatically identifying and killing processes holding locks on critical database files (.mdf, .ldf, .edb) so they can be encrypted cleanly without crashing the host. To maximize encryption velocity before defenders can isolate endpoints, modern payloads replace sequential directory walks with I/O Completion Ports (IOCP) and asynchronous thread pools scaled to CPU core counts (2 * NumberOfProcessors), locking hundreds of gigabytes per minute.

To kill defenders outright, the dominant technique is Bring Your Own Vulnerable Driver (BYOVD) — dropping a legitimately signed but exploitable kernel driver (RTCore64.sys, Truesight.sys, gdrv.sys, and dozens more) to disable EDR sensors from Ring 0; estimates put BYOVD in roughly a quarter of 2024 ransomware attacks. EDR-killing has itself become a product: FIN7 built and sold AvNeutralizer / AuKill to Black Basta, BlackCat, LockBit, MedusaLocker, AvosLocker, and Trigona; EDRKillShifter, first tied to a RansomHub affiliate in 2024, has since been observed in use by at least eight groups including BlackSuit, Medusa, Qilin, and DragonForce. Older and simpler: rebooting the host into Safe Mode, where third-party EDR does not load, before running the locker — pioneered by Snatch in 2019 and reused by REvil, BlackMatter, and RansomHub. Cobalt Strike, once ubiquitous, has partly given way to Sliver, Brute Ratel, and Havoc as its detections matured, and to outright abuse of legitimate remote-management tools (AnyDesk, Atera, Splashtop, ConnectWise ScreenConnect).

Data extortion and cyberextortion supplanting the locker. For a growing share of incidents there is no locker, no encryption, and no malicious binary executed on an endpoint at all — only stolen credentials, cloud or SaaS API calls, and an extortion email. While often loosely labeled "ransomware without ransomware," technical hygiene classifies this as pure data extortion or cyberextortion: the attack bypasses availability destruction entirely and operates strictly on confidentiality compromise. The 2024 Snowflake campaign (UNC5537) is one reference case: infostealer-harvested credentials for ~165 customer data warehouses, bulk export via SQL, extortion. The 2025 Salesforce campaign is the larger one: an alliance branding itself Scattered LAPSUS$ Hunters (Scattered Spider + LAPSUS$ + ShinyHunters; Google tracks the activity as UNC6040 and UNC6395) used voice phishing and abuse of Salesloft Drift OAuth tokens to pull data from hundreds of Salesforce tenants, then stood up a leak site in October 2025 naming Cisco, Disney, Marriott, and others. Defences built around endpoint EDR, kernel minifilters, and file-encryption canaries do not see this class at all.

Law enforcement got aggressive, and the brands fragmented and reconsolidated. The FBI's December 2023 disruption of ALPHV, the February 2024 Operation Cronos takedown of LockBit, the January 2023 dismantling of Hive (with seven months of covert FBI access and 1,300+ keys handed out), a 2025 DOJ action against BlackSuit (servers, domains, ~$1M seized), and repeated 2025 breaches of LockBit's panels by "xoxo from Prague" all degraded specific brands. None of it emptied the ecosystem. When RansomHub — the most active operation of 2024 by leak-site claims — vanished in April 2025, its affiliates moved within weeks to Qilin, Akira, and DragonForce. By Q2 2026 the top three by claim volume were Qilin (dominant since March 2025), Akira, and The Gentlemen, within a handful of claims of each other — and LockBit had staged a real return: LockBit 5.0, released September 2025, posted 163 victims in Q1 2026, back to a top-five position. Other current brands carry their own histories: Rhysida is assessed by Sophos and a joint CISA/FBI advisory to be the old Vice Society operation renamed. Trackers recorded 2025 as the most active year on record — a count of inflated attacker claims, but the direction is not in doubt — even as revenue and payment rates fell.

How the way in changed

If any single thing separates the last decade of ransomware from the decade before it, it is the initial-access vector, which has moved through five overlapping phases. Understanding the current phase is what tells a defender where to spend money.

1. Exposed RDP (roughly 2016–2020). Brute force and credential stuffing against internet-facing Remote Desktop; the staple of Dharma, Phobos, GandCrab, and SamSam. For years this was the single largest category of ransomware access.
2. Mass edge-appliance exploitation (2019–2021). Attackers moved from opportunistic RDP to campaign-scale exploitation of VPN and gateway bugs — Pulse Secure CVE-2019-11510, Citrix ADC CVE-2019-19781, Fortinet CVE-2018-13379, then Microsoft Exchange ProxyLogon/ProxyShell (CVE-2021-34473) in 2021.
3. Loader-brokered access (2020–2022). Malware-spam botnets — Emotet, TrickBot, BazarLoader, QakBot, IcedID — sold or handed footholds to ransomware operators, compressing the chain from phishing email to domain-wide encryption to under 24 hours in the fastest cases.
4. The infostealer-log economy (2022–present). Redline, Raccoon, Vidar, Lumma, and StealC harvest credentials and session cookies (which bypass MFA) at scale; logs are sold in bulk on Telegram channels and dedicated markets. This is the access path behind the Snowflake campaign and a large share of "valid account" intrusions.
5. Help-desk and identity social engineering (2023–present). Scattered Spider's model: call the IT help desk as an employee, talk an agent into resetting MFA, walk in through the front door. Increasingly paired with SIM-swapping and AI voice cloning.

These do not replace one another; they stack. Mandiant's 2025 incident data attributes roughly a third of ransomware cases to confirmed or suspected exploitation of a vulnerability, most often in a VPN or firewall — phase 2, still running a decade later, alongside all the others.

How to classify a ransomware operation

"Ransomware group" is doing a lot of work as a category. A more useful description places an operation on three independent axes at once.

• By mechanism — what it does to the data. Lockers (no file crypto), symmetric crypto (key in the binary, reversible), hybrid crypto (an asymmetric key — RSA or elliptic-curve — protecting a per-file symmetric key; the modern default, engineered with intermittent stride patterns for speed and entropy evasion), wipers (destructive, disguised as ransomware), and pure data extortion (no payload or encryption; leverage is purely non-disclosure of exfiltrated data).
• By target surface — what it runs against. Consumer endpoints at volume; Windows/Active Directory estates pushed from a domain controller; bare-metal hypervisors; or internet-facing edge appliances and file-transfer products exploited en masse.
• By business model — how the crew is organised. A closed private crew; a Ransomware-as-a-Service platform with rented affiliates; a data-broker/extortion group that runs a leak site but no locker of its own; or an access-driven collective that social-engineers the intrusion and rents whatever locker is available.

Scattered Spider shows why one label is not enough: it writes no ransomware, targets identity providers and help desks, and has deployed ALPHV, RansomHub, Qilin, and DragonForce payloads in turn.

Family trees of the major syndicates

The underground rebrands constantly — after law-enforcement heat, after a code leak, after an internal split, and (a fourth driver, specific to one lineage) to evade sanctions — but the personnel, infrastructure, and source code carry across. Six lineages account for most of the consequential activity of the last several years. The links within them vary in strength: some are confirmed by leaked source code or indictments, others are vendor assessments based on code overlap or shared infrastructure. The diagram below draws them all as lines; the text says which is which.

The Wizard Spider / Conti lineage. The crew CrowdStrike tracks as Wizard Spider — widely assessed to include personnel from the Dyre banking-trojan operation that Russian authorities dismantled in 2015 — built TrickBot (2016) into an industrial malware-delivery botnet, used it to deploy Ryuk (2018), and launched Conti (2020) as a structured enterprise with salaried developers, an HR function, and negotiation teams. After Conti's leadership publicly backed Russia's invasion of Ukraine in February 2022, a party with insider access published tens of thousands of internal Jabber messages and the ransomware source — the ContiLeaks. Facing sanctions exposure, the brand was retired and its people dispersed. Multiple vendors track Conti-linked personnel into Black Basta (2022, itself imploded in 2025 amid its own chat leak) and Royal → BlackSuit (built by senior Conti operators, run as a closed crew) — both well supported by code and infrastructure overlap. Akira (2023) is a weaker link: its early C++ builds shared some code with Conti v2, but the group has not been firmly tied to Conti personnel. BlackByte and Karakurt (Conti's own data-theft arm) are documented; Cactus is the weakest of the set — the tie is affiliate migration reported after Black Basta's 2025 collapse, not shared code.

The GandCrab → REvil lineage. GandCrab's operators announced retirement in mid-2019 claiming $2 billion in proceeds. REvil/Sodinokibi had already appeared in April 2019, spreading through an Oracle WebLogic flaw (CVE-2019-2725); Secureworks' Counter Threat Unit, which tracks the developers as GOLD SOUTHFIELD, assessed the same people were behind both (the two ransomwares were briefly observed being deployed from the same compromised servers). REvil ran the July 2021 Kaseya VSA supply-chain attack (800–1,500 downstream businesses), drew intense US pressure, and was effectively ended by Russian FSB arrests in January 2022 — arrests widely read as a diplomatic gesture that did not survive the invasion.

The Evil Corp lineage — rebranding to dodge sanctions. Evil Corp (tracked as INDRIK SPIDER), built around Maksim Yakubets, ran the Dridex banking trojan and the BitPaymer ransomware. In December 2019 the US Treasury's OFAC sanctioned the group by name and indicted Yakubets with a $5 million bounty. That made paying an Evil Corp ransom a potential sanctions violation, and most incident-response firms stopped facilitating payments to any locker attributed to them. Evil Corp's response was a series of rebrands — WastedLocker (2020), then Hades, PhoenixCryptoLocker, and Macaw — each abandoned as researchers re-attributed it. In June 2022 Mandiant reported that Evil Corp affiliates had begun deploying LockBit, a third party's RaaS, and assessed the switch was to break the attribution chain that a sanctions check depends on. The UK NCA's October 2024 "Evil Corp: Behind the Screens" report and a coordinated US/UK/Australia sanctions round reinforced the LockBit tie and named Aleksandr Ryzhenkov as both a senior Evil Corp figure and a LockBit affiliate. This lineage is the reason a defender's payment decision now has to start with a sanctions-attribution question, not a price.

The DarkSide → RansomHub lineage. After Colonial Pipeline, DarkSide rebranded to BlackMatter (2021), then re-architected in Rust as ALPHV/BlackCat (late 2021). In February 2024 an ALPHV affiliate extorted a $22 million payment from Change Healthcare; ALPHV's core operators took the entire sum, suspended the affiliate, and posted a fake law-enforcement seizure notice — an exit scam. The stranded affiliate still held the data and moved to RansomHub, a new operation that launched the same month. Symantec and others assess RansomHub's C++/Go payload as derived from the Knight (formerly Cyclops) codebase, whose source was advertised on RAMP in February 2024; later reporting also ties RansomHub's operators to the ALPHV network. RansomHub's industry-high 90% affiliate split pulled in displaced ALPHV and LockBit crews, until it too went dark in early 2025 and its affiliates scattered to Qilin, Akira, and DragonForce.

The Babuk mutation tree. Babuk drew heavy law-enforcement attention after an April 2021 breach of the Washington, DC Metropolitan Police Department. Its builder had already surfaced on VirusTotal that June, and in September 2021 a disaffected member posted the fuller multi-platform source code on XSS, including a working C++ ESXi locker. SentinelLabs later counted at least ten distinct ESXi-locker families built on that leaked code, including Cheerscrypt, RA Group, RTM Locker, Rorschach (BabLock), and the Linux variant of Play. The leak did more to spread hypervisor-ransomware capability than any single group's own development.

The Hive → World Leaks lineage. After the January 2023 takedown of Hive, a new brand, Hunters International, appeared in October 2023; Bitdefender assessed roughly 60% code overlap with Hive v6. Its operators publicly denied being a rebrand, saying they had bought the source and infrastructure. Hunters announced its own closure on 17 November 2024, citing unprofitability and law-enforcement pressure — but Group-IB assessed that the operation simply continued as World Leaks, an encryption-free data-extortion brand it launched on 1 January 2025 with a custom exfiltration tool for affiliates. The Hunters encryption operation was wound down (with a symbolic offer of free decryptors) by mid-2025 — a full-circle return to the Cl0p model.

The Ransomware-as-a-Service economy

RaaS is best understood as criminal franchising with a specialised labour market attached. The work is divided, and each role is paid a defined cut.

• Initial Access Brokers sell the foothold — stolen VPN credentials, infostealer logs (Lumma, StealC, Redline), exposed RDP, or an exploited edge device — for a flat fee that scales with the target's revenue, from a few hundred dollars to $50,000 and up.
• Affiliates (the intrusion crews) buy or find access, escalate privileges with commodity tooling (Cobalt Strike, Impacket, Mimikatz), map and exfiltrate data with Rclone, and deploy the core team's locker across the estate. They keep the large majority of each ransom — typically 80–90%.
• Core operators build and maintain the encryptor and the affiliate panel, host the Tor infrastructure and leak site, and often run the victim-facing negotiation chat. They take 10–20%.
• Contracted specialists are hired per job or per build: EDR-killer developers (the "bring your own vulnerable driver" tool EDRKillShifter is associated with RansomHub), call-centre operators for harassment, and money-laundering networks that take roughly 5–15% of the funds they clean.

This structure is why takedowns underperform expectations. Seizing a leak site removes a brand's storefront, not its developers, its affiliates, its access brokers, or its launderers — and those can reassemble around a new name in weeks. The leaked LockBit, Conti, and Black Basta panels and chat logs all show the same thing: a functioning small business with staff, payroll disputes, and customer support.

The cash-out. Most groups still demand Bitcoin despite its traceability, because liquidity matters more than privacy at payout time; some offer a discount for Monero. The laundering step then runs the proceeds through mixers and non-compliant exchanges. Sustained pressure on that layer is one of the few interventions with measurable effect: the US sanctioned the mixer Tornado Cash (August 2022) and the exchange Garantex (2022, for laundering Conti and Black Basta funds), the FBI and partners shut down ChipMixer (March 2023) and later sanctioned Sinbad (November 2023), and an international operation seized Garantex's infrastructure in March 2025. Chainalysis attributes part of the 2024 drop in ransom revenue to this — funds sitting unlaundered in wallets rather than being cashed out — alongside the falling payment rate.

Cyber insurance shaped the demand side. Insurance is one of the largest forces on the ransomware economy over the last six years, and it cuts both ways. Through roughly 2019–2021 it made payment the path of least resistance, and — because attackers routinely read a victim's email for weeks before acting — they learned to find the cyber-insurance policy in the mailbox and anchor the demand to its limits (a tactic documented directly in the leaked Conti affiliate training material). Since then, the US GAO and the carriers themselves report that insurers tightened underwriting — requiring MFA, EDR, and offline backups as a condition of coverage, and imposing ransom sub-limits and co-insurance — and ransomware claim frequency and severity fell as a result. The controls insurers now mandate are, not coincidentally, most of the defensive checklist below.

Inside the negotiation

Because several groups have had their negotiation chats leaked wholesale, and because researchers and incident responders have assembled normalised corpora of thousands of transcripts, the bargaining behaviour is unusually well characterised — though it is worth remembering the public transcript sets are skewed toward the groups that got breached, not a random sample.

The consistent picture across Coveware's quarterly analyses, the Ransomchats corpus, and a 2025 Tinbergen Institute working paper ("The Ransomware Pricing Paradox", modelling 481 police-reported incidents plus a second set of 237) is that negotiation is a multi-stage bargaining game, not a fixed ultimatum. Attackers open with a demand anchored to the victim's estimated revenue — and, when they have it, to the cyber-insurance policy limits found during reconnaissance — then concede in dramatised steps. Coveware's data puts the eventual paid amount at roughly 8.7% of the initial demand on average (Q4 2024).

Two things are worth stating carefully, because the popular version overstates them:

• "Bigger discounts cause payment" is not well supported once the victim's preparedness and the opening price are controlled for. A large headline discount is partly theatre that helps a victim's leadership and insurer justify a settlement; it is a weak predictor of the outcome on its own.
• The most effective thing a victim can do at the table, per incident responders, is calmly demonstrate that independent backup recovery is under way. That shifts the attacker's leverage away from business-interruption pricing toward pure data-non-disclosure pricing. Treat the magnitude as situational, not a fixed percentage.

Re-extortion is a real residual risk. Paying buys a decryptor and a promise; incident responders have documented cases of the same data being sold or re-used against the same victim later, sometimes under a different brand.

Where the operators talk, and where you can watch

This is the question FlagThis readers ask most about ransomware, so it gets its own section — with one deliberate limitation. This piece does not publish live onion addresses, Telegram handles, or Tox IDs. They rotate constantly, a stale one in a research post is worse than useless, and the useful ones are already indexed by the trackers below.

The infrastructure a group runs

Converting access to money takes a small stack of services: a data-leak site (a Tor v3 onion service with countdown timers and "proof" samples, usually mirrored to clearweb proxies on bulletproof hosting so executives and journalists who cannot reach Tor still see the pressure); a per-victim negotiation portal reached with a token from the ransom note, with fallback to the Tox protocol (serverless P2P, a Tox ID in the note — used by BianLian and others) or a private Matrix / Rocket.Chat homeserver (Black Basta's leaked chats ran on exactly this); and data staging via Rclone/MEGAcmd to MEGA and Wasabi, BitTorrent for the biggest dumps, and compromised NAS as a relay.

The communication layer

• Dedicated forums. After the May 2021 XSS/Exploit ransomware bans, RAMP became the primary forum for ransomware recruitment and RaaS business, hosting LockBit, ALPHV, Conti-successors, Qilin, and RansomHub. The FBI seized RAMP's Tor and clearnet domains on 28 January 2026; the seizure banner reused the forum's own slogan. XSS lost its administrator ("Toha") to a Europol/SBU arrest in Kyiv in July 2025, though the forum reappeared at a new address within days. Recruitment has not stopped — it has dispersed to general-purpose forums and private channels, where the ban-era euphemism ("looking for pentesters," "for a percentage of the profit") persists.
• Telegram carries public-facing victim claims and some recruitment — Scattered Spider–adjacent channels and hacktivist-branded personas in particular. More accessible and more ephemeral than a Tor forum; channels are banned and rebuilt regularly.

The public resources that track it

A practical workflow: watch one of the open trackers (or its RSS/API) for new victim claims and new group names; when a new brand appears, check Malpedia and vx-underground for whether its code descends from a disrupted predecessor; cross-reference the relevant CISA advisory for IOCs; and use ransomwhe.re to see whether payments are actually flowing to it. Rebrands and affiliate migrations are usually visible in that data within days.

The paper trail: leaks, indictments, and CVEs

Everything above describes behaviour. This section is the receipts — the specific primary-source artefacts behind the claims.

• LockBit. First seen September 2019 as ".abcd". Iterated through LockBit 2.0 (the StealBit exfiltration tool) and LockBit 3.0/"Black" (2022, anti-analysis code borrowed from BlackMatter; a "LockBit Green" variant on leaked Conti code). Operation Cronos (20 Feb 2024, UK NCA + FBI + Europol) seized 34 servers; law enforcement then ran the leak site itself for a week to publish decryptors and affiliate details. "xoxo from Prague" leaked the full backend SQL database on 7 May 2025 and defaced the 5.0 panel again that September. LockBit 5.0 ("ChuongDong", late Sept 2025): two-stage loader, ChaCha20/Curve25519, $500 affiliate fee. Despite the humiliations, the relaunch took: LockBit 5.0 claimed 163 victims in Q1 2026 and returned to the top five most active operations.
• The Conti lineage. The ContiLeaks (Feb 2022, 60,000+ Jabber messages plus source) remain the richest primary source on how a large RaaS runs internally — salaries, org structure, wallets, office locations, negotiation playbooks. The Black Basta chat leak (Feb 2025, "ExploitWhispers") did the same for that successor. These leaks are why the Conti-to-successors tree is evidence-backed rather than speculation.
• ALPHV → RansomHub. The FBI's December 2023 disruption (with a decryptor), the Change Healthcare affiliate's own dark-web post claiming the $22M payment and the exit scam, and CISA AA24-242A — which documents RansomHub affiliate use of Zerologon (CVE-2020-1472) and Citrix Bleed (CVE-2023-4966). Symantec traced the RansomHub payload to the Knight/Cyclops code advertised on RAMP in February 2024.
• Babuk. The September 2021 XSS post by "dyadka0220" with Babuk's source and multi-platform builder. SentinelLabs and The Record each traced ten-plus ESXi lockers to it. Cheerscrypt is attributed by Sygnia, Microsoft, and Secureworks to the Chinese espionage actor Bronze Starlight / DEV-0401 (MITRE G1021), which has cycled through LockFile, AtomSilo, Rook, Night Sky, and Pandora as espionage cover — the clearest case of the ransomware form wrapping something else.
• Scattered Spider (UNC3944 / Octo Tempest / Muddled Libra). Help-desk social engineering to reset MFA and seize Okta/Entra access, then legitimate RMM tools for persistence. Has deployed ALPHV, RansomHub, Qilin, and — against Marks & Spencer, Co-op, and Harrods in May 2025 — DragonForce. Prosecutions landed through 2025–2026: Noah Urban ("King Bob") drew a 10-year sentence and $13M restitution; Tyler Buchanan and other members pleaded guilty (several on the first day of trial in June 2026); further arrests followed in the UK, US, and Finland. Activity did not stop — the same personnel, under the Scattered LAPSUS$ Hunters banner with LAPSUS$ and ShinyHunters, ran the 2025 Salesforce/Salesloft-Drift extortion campaign described in Era 5.

The CVEs that carry ransomware

Ransomware crews are overwhelmingly n-day exploiters of internet-facing infrastructure. A representative set from FlagThis's own tracking:

• CVE-2023-0669 (Fortra GoAnywhere MFT), CVE-2023-34362 (Progress MOVEit Transfer), and CVE-2025-61882 (Oracle E-Business Suite) — Cl0p's mass-exploitation campaigns of 2023 and 2025.
• CVE-2023-4966 ("Citrix Bleed") — session-token theft in NetScaler, used by LockBit and Medusa affiliates in late 2023.
• CVE-2024-40766 (SonicWall SSL VPN access control) — the initial-access vector behind a July–August 2025 surge in Akira intrusions, per an updated CISA #StopRansomware advisory that put Akira's proceeds near $244 million by late September 2025.
• CVE-2023-27350 (PaperCut) and CVE-2020-1472 (Zerologon) — recurring across affiliates for access and domain-controller takeover.
• CVE-2023-27532 (Veeam Backup & Replication) — credential extraction from the backup server itself, favoured by Cuba and FIN7-linked crews.
• CVE-2025-53770 (SharePoint "ToolShell"), CVE-2024-55591 (FortiOS auth bypass), CVE-2025-32433 (Erlang/OTP SSH), CVE-2025-33073 (Windows SMB reflection) — among the edge/enterprise flaws named in 2025–2026 ransomware tooling, including The Gentlemen's leaked backend.

State-nexus ransomware

Not every "ransomware" incident is financially motivated crime, and not every financially motivated ransomware operation is free of a state. Several patterns recur:

• North Korea runs ransomware for revenue. Beyond WannaCry (2017), DPRK clusters — chiefly Andariel — have deployed Maui and H0lyGh0st against US and South Korean healthcare providers, documented in CISA advisory AA22-187A and a 2024 DOJ indictment. The proceeds fund sanctioned weapons programs; the healthcare targeting is deliberate, for maximum pressure.
• China uses ransomware as espionage cover. Beyond the Bronze Starlight case in the paper trail below, Microsoft attributed the July 2025 exploitation of the SharePoint "ToolShell" flaw (CVE-2025-53770) by Storm-2603 — a China-based actor — to a campaign that deployed Warlock and, earlier, LockBit Black ransomware onto compromised on-premises servers.
• Russia tolerates, and sometimes appears to shield. The recurring unresolved question across the Conti, REvil, and Evil Corp files is whether these groups are tasked, protected, or merely left alone. The January 2022 REvil arrests and their reversal after the invasion suggest leverage exists and is used selectively.
• Iran-nexus extortion wears a hacktivist face — Pay2Key, HomeLand Justice, and similar personas run encryption and hack-and-leak operations tied to the IRGC. FlagThis covers the wider Iranian state-cyber picture in Iran's State AI Playbook.
• Wipers wear ransomware clothing. NotPetya (2017) and the 2022 Ukraine wave (WhisperGate, HermeticWiper) dropped ransom notes over payloads that were never meant to be reversible — the note as a false flag to delay attribution.

AI in the ransomware toolchain

AI is not the locker and not the thing that makes ransomware work; it changes the cost and skill of the surrounding steps. The evidence base is thin and dominated by the AI vendors' own disclosures — primary sources on misuse of their own products, but also interested parties — so the confidence markers matter.

Access is where the real effect is. LLMs remove the language tells: access crews now send fluent, context-specific phishing in any target language, and Scattered Spider–style operators pair help-desk vishing with AI voice cloning. Incremental, but real, at scale, and aimed at the hard part of a ransomware operation.

The skill floor is lower. Check Point's analysis of FunkSec — a group it concludes is low-tier — found inexperienced actors using AI to assemble a working encryptor and a support chatbot while padding their victim list with recycled hacktivist data: a data point on two things at once, that AI let unskilled people ship a locker, and that their inflated claims corrupt the trackers. Anthropic's August 2025 report separately describes an actor ("GTG-5004") selling AI-built ransomware kits for $400–$1,200 despite "only basic coding skills."

One operator, a crew's work. Anthropic's clearest case is "GTG-2002": one person used Claude Code to run a data-extortion campaign against 17+ organisations — VPN scanning, intrusion, escalation, exfiltration, then the model analysing the stolen data to set the ransom figure and draft the notes ($75k–$500k+ demands). It is the strongest documented case of an AI agent used across an extortion lifecycle — and also one vendor's account of one actor, involving no encryption, where what fell was the orchestration barrier, not a new capability. (PromptLock, briefly mis-reported as criminal AI ransomware in August 2025, was an NYU Tandon research PoC — a payload with no stable code to sign, choosing exfiltrate-versus-encrypt at runtime. No criminal equivalent has been found.)

Where the assessment sits. Google's Threat Intelligence Group and Anthropic still frame AI in offensive operations as acceleration, not a step-change — GTIG's September 2026 report describes "gradual maturation," not autonomy. But GTIG's recent reporting is moving that line: AI-assisted n-day exploit generation from patch disclosures, a zero-day it assesses was likely AI-developed, an agentic credential-harvesting campaign run in under six hours. For ransomware, the honest read: a force multiplier on access, a floor-lowerer for unskilled entrants, the agentic-operator case demonstrated but rare — and a trajectory worth watching, not dismissing.

What actually blunts this

The defensive advice is unusually stable, because the leverage points have not moved much. It maps onto the phases where a ransomware operation is actually stoppable.

Stop the way in. Phishing-resistant MFA (FIDO2/passkeys, not SMS or push-only) on every external surface, with conditional access and alerting on the infostealer-cookie replay path (new-device sign-ins, impossible travel, unexpected MFA registrations). Help-desk identity-proofing that assumes the caller is an attacker. Inventory every internet-facing VPN, firewall, and file-transfer appliance and treat KEV-listed edge CVEs as emergency changes; decommission end-of-life VPNs. Since AI has removed the grammatical tells from phishing, raise identity assurance rather than relying on users to spot a bad email.

Stop the escalation and spread. Enable EDR tamper protection; deploy Microsoft's vulnerable-driver blocklist with HVCI/WDAC against BYOVD; alert on new kernel-driver loads, on bcdedit /set safeboot, and on EDR agent stops or telemetry gaps. Segment the hypervisor management network, Tier-0 identity infrastructure, and OT — separate credentials, no line of sight from a standard workstation, no AD join for ESXi management. Just-in-time admin and no permanent domain-admin accounts turn a compromised laptop into a contained incident rather than a domain-wide one.

Stop the impact, and survive it if you can't. Backups that survive a full domain compromise: immutable plus offline/air-gapped, backup infrastructure on a separate identity plane, the backup server itself patched (attackers target it first), restores tested at production scale. Understand detection limitations: canary/honey files serve as valuable tripwire alerts, but because modern lockers deploy multithreaded I/O Completion Ports (IOCP) and intermittent encryption, canaries fire during ongoing destruction rather than preventing it — automated host isolation must be triggered immediately. Detect exfiltration before the locker runs: egress-volume monitoring, alerts on Rclone/MEGAcmd and rare cloud-storage destinations, and canary cloud credentials. Instrument for behaviours, not brands: monitor not just command-line vssadmin or wmic shadowcopy delete, but programmatic abuse of VSS COM interfaces (IVssBackupComponents) and shadow-storage resizing (vssadmin resize shadowstorage /maxsize=401MB, which silently purges snapshots); alert on bcdedit /set safeboot, LSASS access, Windows Restart Manager API calls against core databases, mass file-extension renames, first-seen RMM installs, and bursts of nltest / AD reconnaissance.

Decide in advance. Make the payment decision before the incident — including a sanctions-attribution check (paying a sanctioned group can itself be unlawful), an IR retainer, legal on standby, and a disclosure playbook so the regulator clock does not set the terms. Tabletop the "the data is already gone" scenario, not just "the files are encrypted."

At the ecosystem level, the interventions with visible effect are coordinated disruption (Cronos, the Hive operation), sanctions and indictments, pressure on the laundering layer, and the insurance-underwriting controls above. Mandatory ransom-payment reporting and outright payment bans remain debated.

Timeline

The bottom line

Ransomware's history is not a sequence of discrete threats but one long process of adding leverage without ever giving any up. The 1989 version could be beaten by reading the key out of the binary. The 2013 version defeated that with server-held asymmetric keys and made payment frictionless with Bitcoin. The 2019 version defeated backups by stealing the data first. The 2023 version dispensed with encryption where the data alone was enough, and the current version stacks DDoS, harassment, and regulatory pressure on top. Any defence built against one layer — even a very good one, like immutable backups — leaves the others intact. That is the single most important thing to understand about the threat, and it is why "are we protected against ransomware?" is not a question with a yes/no answer.

The second thing is that the underground behaves like an industry with a labour market, not a collection of gangs. Brands are disposable; developers, affiliates, access brokers, and launderers are not — which is why Operation Cronos, the Hive takedown, and the RAMP seizure all imposed real friction without emptying the ecosystem. It is also, as the OSINT section shows, one of the most observable criminal economies in existence: a defender does not have to go on the dark web to follow it.

Is it getting better or worse? Both. By the numbers that measure the criminal business — payment rate, on-chain revenue, the survival time of a big brand — defenders are winning: the payment rate is at a record low near 28%, on-chain revenue is down roughly a third from its 2023 peak, and no dominant syndicate has lasted more than a couple of years since 2022. By the numbers that measure exposure — claimed victims (up ~50% in 2025), the number of active brands, speed from intrusion to impact — they are not. And the loss is shifting from "your files are locked" (which mature backups and incident response now handle reasonably) to "your data is gone and it is a legal and reputational problem" (which almost nothing fully answers). The access vector, meanwhile, keeps moving toward identity — stolen cookies, help-desk manipulation, AI-assisted phishing — so the defensive centre of gravity is moving off the endpoint onto identity infrastructure most organisations instrument poorly. An organisation that has solved the encryption problem and not the data-theft problem has solved the easier half.

This is a living research post. The named groups, the family trees, and especially the payment and volume figures change quarter to quarter; as they do, the analysis above will be revised rather than appended to, and every change is logged in the revision history below.

Sources

History and lineage

• A Brief History of Ransomware — Varonis
• Petya and Mischa Ransomware Affiliate System Publicly Released — BleepingComputer
• CryptoLocker — Wikipedia (well-sourced overview)
• WannaCrypt ransomware worm targets out-of-date systems — Microsoft
• Statement from the Press Secretary on NotPetya (15 Feb 2018) — The White House
• Big Game Hunting with Ryuk — CrowdStrike
• TRM Analysis Corroborates Ties Between Conti, Ryuk and Wizard Spider — TRM Labs
• Is 'REvil' the New GandCrab Ransomware? — Krebs on Security
• REvil Ransomware: The GandCrab Connection — Sophos
• Ransomware Evolved: Double Extortion Attacks — Check Point Research
• Egregor operation takes huge hit after police raids — Intel 471
• Conti Ransomware Group Diaries — Krebs on Security
• Black Basta Leak Offers Glimpse Into Group's Inner Workings — SecurityWeek
• Black Basta Goes Dark Amid Infighting, Chat Leaks Show — Dark Reading
• A ransomware source code leak spawned at least 10 'Babuk' imitators — The Record
• Hypervisor Ransomware: Multiple Threat Actor Groups Hop on Leaked Babuk Code — SentinelLabs
• Revealing Emperor Dragonfly: Night Sky and Cheerscrypt — Sygnia
• Cinnamon Tempest / DEV-0401 / BRONZE STARLITE (G1021) — MITRE ATT&CK
• BlackCat Ransomware Group Implodes After Apparent $22M Payment by Change Healthcare — Krebs on Security
• #StopRansomware: RansomHub Ransomware — CISA AA24-242A
• RansomHub extortion gang linked to now-defunct Knight ransomware — BleepingComputer
• #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit — CISA AA23-158A
• Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign — Google Cloud / Mandiant
• Thus Spoke… The Gentlemen (Rocket backend leak analysis) — Check Point Research
• Akira ransomware targeting SonicWall SSL VPN — Arctic Wolf
• Disrupting active exploitation of on-premises SharePoint vulnerabilities — Microsoft
• ShinyHunters claims 1.5 billion Salesforce records stolen in Drift hacks — BleepingComputer
• Scattered Spider hackers plead guilty on day 1 of trial — Krebs on Security
• Hunters International rebrands as World Leaks in shift to data extortion — BleepingComputer
• #StopRansomware: Rhysida Ransomware — CISA AA23-319A
• Unmasking The Gentlemen Ransomware — Trend Micro

Sanctions, arrests, and disruptions

• Kaseya VSA Supply-Chain Ransomware Attack — CISA AA21-183A
• Russia arrests, dismantles REvil hacking group at US request — Reuters
• Russian cybercrime forum XSS claims to ban ransomware following Colonial Pipeline hack — CyberScoop
• Who Is the Network Access Broker 'Wazawaka'? — Krebs on Security
• FBI seizes RAMP cybercrime forum used by ransomware gangs — BleepingComputer
• Key figure behind major Russian-speaking cybercrime forum targeted in Ukraine — Europol
• Operation Cronos: The Takedown of LockBit Ransomware Group — Arctic Wolf
• Xoxo to Prague — Cisco Talos
• Evil Corp hit with new sanctions, BitPaymer ransomware charges — BleepingComputer
• Evil Corp's LockBit Ties Exposed in Latest Phase of Operation Cronos — Infosecurity Magazine
• Sanctioned Russian crypto exchange Garantex seized — CyberScoop
• US Sanctions Crypto Mixer Sinbad.io — Chainalysis
• Conti ransomware gang member sentenced to four years in prison — BleepingComputer

Economics, negotiation, and insurance

• Ransomware Quarterly Reports — Coveware
• Coveware ransomware recovery blog
• Crypto Ransomware — 2026 Crypto Crime Report — Chainalysis
• The Ransomware Pricing Paradox — Tinbergen Institute (working paper)
• Casualtek / Ransomchats — negotiation transcript corpus (GitHub)
• Cyber Insurance: Insurers and Policyholders Face Challenges — US GAO GAO-21-477
• How Hackers Leverage Insurance Details in Ransomware Attacks — Coalition

Initial access, evasion, and AI

• Stay Ahead of Ransomware: Initial Access via Evolving Social Engineering — SANS
• UNC5537 Snowflake Data Theft and Extortion — Google Cloud / Mandiant
• New EDR killer tool used by eight different ransomware groups — BleepingComputer
• Hunting for RansomHub and Antivirus Killers — Intel 471
• Ransomware Developers Turn to Intermittent Encryption — Cloud Security Alliance / SentinelLabs
• Detecting and countering misuse of AI: August 2025 — Anthropic
• GTIG AI Threat Tracker: From Prompting to Autonomy — Google Threat Intelligence Group
• FunkSec – Alleged Top Ransomware Group Powered by AI — Check Point Research
• First known AI-powered ransomware uncovered by ESET Research — WeLiveSecurity (later corrected)
• AI-Powered Ransomware That Sparked Concern Was NYU's Work — NYU Tandon
• North Korean State-Sponsored Actors Use Maui Ransomware to Target Healthcare — CISA AA22-187A
• #StopRansomware: BianLian Ransomware Group — CISA AA23-136A
• The No More Ransom Project
• Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware — The Hacker News
• McKesson copes with fallout from data theft extortion attack — CyberScoop

OSINT trackers and archives

• About — Ransomware.live
• RansomLook — About
• ransomwatch — the transparent ransomware claim tracker (GitHub)
• ransomwhere — the open ransomware payment tracker
• Casualtek/Ransomchats (GitHub)
• vx-underground
• Malpedia — Fraunhofer FKIE
• eCrime.ch
• StopRansomware.gov — CISA