Data exfiltration (extortion-only model)
Purchase of access from Initial Access Brokers (IABs)
Brute-force credential attacks
Password spraying
Exploitation of exposed Remote Desktop (RDP) gateways
Credential harvesting
Use of Data Leak Sites (DLS) for pressure
Negotiation via Tor-based chat portals