SECTION 1 — WHAT IT IS

1.5 Structural Variants — Five Archetypes

The ransomware group landscape comprises five identifiable structural archetypes, each with distinct risk and disruption profiles:

Archetype 1 — Classic RaaS Platform Operators: Full-stack programs serving a broad affiliate pool. Operators develop and maintain encryptors, decryptors, and supporting tooling. They host Tor-based leak sites, payment portals, and affiliate dashboards. They define revenue models, enforce targeting rules (e.g., CIS exclusion filters), and provide branding and playbooks. LockBit, ALPHV/BlackCat, and RansomHub are exemplars; all three are defunct or disrupted as of mid-2026. Current archetype exemplars: Qilin, DragonForce.

Archetype 2 — High-End Big-Game Crews: RaaS variants optimized for large-enterprise targets. These groups prioritize victims with high revenue capacity, use advanced initial access methods (zero-day and N-day exploits against edge devices), and employ structured multi-stage extortion including triple extortion (encrypt, exfiltrate, notify customers/regulators). Cl0p, BlackCat in its mature phase, and Black Basta are exemplars.

Archetype 3 — Mass-Market RaaS Kits: Commodity platforms sold via subscription or one-time license to low-skill actors. These prioritize volume over per-victim value. Affiliates rely on phishing, basic IAB access, and opportunistic exploitation rather than bespoke zero-days. Revenue per incident is lower but the affiliate pool is substantially larger.

Archetype 4 — Cartel-Style Coalitions: Post-disruption structures in which multiple groups share leak platforms, payment backends, and negotiation infrastructure under a loosely coordinated umbrella. These absorb displaced affiliates from disrupted major brands and use cartel-like coordination to manage victim negotiations and inter-group conflicts over access.

Archetype 5 — Operator-Affiliate Hybrids (Semi-RaaS): Groups that develop ransomware, run high-value campaigns internally, and selectively recruit a small affiliate cadre for secondary targets. These maintain centralized control over victim selection and negotiation. The Scattered Spider collaboration with ALPHV and later RansomHub is a documented example.

SECTION 2 — KEY ACTORS AND EXAMPLES

2.1 Named Actor Archetypes Table

2.2 Notable Documented Examples

LockBit 3.0 / LockBit Black: The most prolific RaaS platform by victim count before its February 2024 disruption by Operation Cronos. LockBit operated an affiliate program with publicly posted revenue splits, a bug-bounty program, and a corporate-style brand. Post-disruption, core developers attempted to relaunch as LockBit 4.0 while affiliates migrated primarily to RansomHub and BlackSuit (both since gone: RansomHub dark April 2025; BlackSuit leak and negotiation sites seized in Operation Checkmate, July 2025; the later affiliate destination is Qilin).

ALPHV/BlackCat: A sophisticated Rust-based RaaS that operated from 2021 to early 2024. Targeted healthcare extensively in its final months. Following a December 2023 FBI disruption and seizure, ALPHV operators conducted an apparent exit scam, withholding a USD $22M affiliate payment related to the Change Healthcare attack before shutting down infrastructure.

RansomHub: Emerged in early 2024 and rapidly absorbed displaced ALPHV and LockBit affiliates. By mid-2024 it was the most active group by victim postings. It operated as a classic affiliate split model and did not conduct intrusions directly, and was notable for posting victims within days of breaches and applying aggressive leak-site pressure. RansomHub went dark on 1 April 2025 (apparent exit-scam pattern); its displaced affiliates dispersed primarily to Qilin and DragonForce. Read the description above as historical.

Cl0p: Persistently exploits mass-vulnerability events in file-transfer and managed-file-transfer products (MOVEit Transfer, GoAnywhere, Accellion FTA). Each campaign generates hundreds of simultaneous victims. Uses a hybrid model with an internal technical team conducting exploitation and an affiliate or partner layer for secondary monetization.

Black Basta: Operated primarily 2022-2025; targeted large enterprises in manufacturing, healthcare, and critical infrastructure. Used Qbot/QakBot loader (pre-takedown) and later Pikabot for initial access. Sophisticated double-extortion model with structured negotiation. Internal chat logs leaked in early 2025 revealed operational details and state-adjacency indications.

2.3 Geographic Concentration

Russia and CIS states remain the dominant hosting environment for major RaaS operator infrastructure and the primary language of top-tier affiliate communities. Key indicators:

• Virtually all major RaaS platforms embed CIS/RU targeting exclusion filters, limiting domestic victim exposure and signaling awareness of implicit state-tolerance arrangements.
• Primary developer and administrator personas for LockBit, ALPHV, Black Basta, and RansomHub have been assessed (CONFIRMED or CREDIBLE) as Russia-based through law-enforcement indictments, infrastructure analysis, and leaked communications.
• English-language actors (Scattered Spider/UNC3944) have demonstrated the ability to integrate into RaaS ecosystems as privileged affiliates, illustrating that the ecosystem is not exclusively Russian-operated at the affiliate layer.
• North Korean state-affiliated actors (Lazarus Group, TraderTraitor) use ransomware tactically for revenue generation but operate through separate infrastructure and TTPs distinct from the RaaS market.

2.4 Scale and Volume Table

2.5 State Adjacency Assessment

Dark Covenant 3.0 screening is applicable to major RaaS operators. The following state-adjacency indicators are present:

• CIS/RU targeting exclusion filters embedded in operator platforms constitute the clearest structural indicator of implicit FSB/MVD tolerance, not passive; operators actively maintain rule-sets to protect domestic targets.
• ALPHV/BlackCat operations during 2023-2024 included targeting of organizations perceived as hostile to Russian state interests, suggesting possible opportunistic alignment rather than formal direction.
• Black Basta leaked chat logs (early 2025) referenced interactions with individuals assessed to have connections to Russian organized crime networks with state adjacency; confidence: CREDIBLE based on single-source reporting.
• No CONFIRMED evidence of direct GRU or SVR operational tasking of commercial RaaS groups exists in open reporting. FSB protection-tolerance relationship is the primary documented model.
• Analyst inference: Major RaaS operators operating at scale from Russian territory without disruption by Russian authorities are implicitly protected; operators who become inconvenient (politically or due to Western pressure) face selective enforcement (Revil 2022, post-Colonial Pipeline pressure).

Confidence note: CONFIRMED for CIS filter evidence; CREDIBLE for Black Basta state-link reporting; ANALYST INFERENCE for broader FSB protection model as applied to current operators.

SECTION 3 — INFRASTRUCTURE DEPENDENCIES

3.1 Upstream Dependencies

RaaS operators depend on the following upstream nodes from the EDP Dependency Map:

3.2 Downstream Outputs

Operator activity drives demand and revenue into the following downstream nodes:

3.3 Critical Chokepoints

3.4 Technical Infrastructure

• Tor-based hidden services for leak sites, payment portals, and negotiation chat; hosted on BPH providers (Node 03) to resist law-enforcement seizure.
• Affiliate management panels running custom or adapted web applications; typically hosted on BPH infrastructure with multi-layered access controls.
• Ransomware builder tools — configurable payload generators allowing affiliates to create victim-specific executables with embedded payment addresses and ransom note templates.
• Cryptocurrency payment infrastructure using Monero (increasingly) and Bitcoin; victim payments received in operator-controlled wallets; affiliate splits routed through automated or manual mixing.
• Exfiltration staging infrastructure (EDP Node 14) used by affiliates to hold stolen data prior to operator-controlled leak-site posting.
• Operational security tooling: VPNs, residential proxies, and anonymization layers (EDP Node 15) used by operators and affiliates to mask administrative access to infrastructure.

3.5 Cross-Module Linkages

SECTION 4 — DISRUPTION LEVERAGE POINTS

4.1 Primary Disruption Levers

RaaS operators are the highest-value disruption target in the ecosystem due to their aggregation function. However, direct operator-level disruption (arrest, indictment, infrastructure seizure) is resource-intensive, and groups reconstitute quickly. The following levers are assessed in order of leverage-to-cost ratio:

4.2 Compounding Disruption Actions

The following actions compound the primary levers when executed concurrently or in rapid sequence:

• Simultaneous leak-site seizure and decryptor publication: Removes both extortion pressure and technical leverage from operator in a single operation. Demonstrated effectively in Operation Cronos against LockBit.
• OFAC designation timed with law-enforcement press conference: Combines financial isolation with reputational damage and affiliate deterrence in a single message cycle.
• Affiliate diaspora tracking following major takedown: Post-disruption monitoring of underground forums (Node 07) for affiliate migration patterns to emerging brands; allows early pressure on successor groups before they consolidate.
• Decryptor tool release to victims concurrent with media outreach: Reduces victim payment incentive, degrading operator revenue and demonstrating law-enforcement capability to the affiliate community.
• Blockchain wallet cluster designation: Following identification of a new RaaS payment wallet cluster, rapid OFAC designation creates compliance obligations for any exchange or OTC broker processing funds from those addresses.
• Healthcare-sector rapid notification: Given the disproportionate targeting of healthcare (700+ breaches, 275M+ records), rapid victim notification programs and sector-specific decryptor provision reduces payment rates in the highest-profile vertical.

SECTION 5 — RESILIENCE AND REPLACE DIFFICULTY

5.1 Replace Difficulty Assessment

5.2 Redundancy and Structural Resilience

• The RaaS ecosystem is structurally resilient because operator disruption directly produces affiliate diaspora, which seeds new groups. Each major takedown (REvil 2021, LockBit 2024, ALPHV 2024) resulted in measurable new group formation within 60-90 days.
• Brand fragmentation increases total ecosystem attack surface: 55 new groups in 2024 means law enforcement must monitor more targets with similar resources. Fragmentation is a resilience feature, not a vulnerability.
• Ransomware source code leakage (LockBit 3.0 builder leak 2022, Babuk leak 2021, Conti leak 2022) has dramatically lowered barriers to entry for new operators; new groups do not need to develop encryption capability from scratch.
• CIS exclusion filters create a protected domestic operating environment; Russian state tolerance (Dark Covenant model) provides structural protection from the most capable law-enforcement actors.
• Operational security improvements post-2022 (increased use of Monero, end-to-end encrypted negotiation, shorter operational lifespans for individual brands) reflect ecosystem-level adaptation to law-enforcement pressure.

5.3 Historical Reconstitution Table

5.4 Ecosystem Adaptation Patterns

The ransomware ecosystem has demonstrated consistent adaptation patterns in response to law-enforcement pressure:

• Operational lifespan reduction: Groups operate for shorter periods under a single brand before rebranding; reduces cumulative intelligence collection value of any single brand.
• Infrastructure decentralization: Post-Cronos, operators have increased use of decentralized hosting, multiple redundant leak sites, and faster infrastructure rotation.
• Affiliate trust degradation response: Following ALPHV exit scam, some operators have published "proof of funds" or escrow arrangements to reassure affiliates; illustrates ecosystem-level reputational management.
• Monero adoption: Increasing migration from Bitcoin to Monero for affiliate payouts and some victim payments; directly responds to Chainalysis tracking capability.
• Target profile normalization: Shift toward "scalability" model (repeatable, systematic recon and exploitation) rather than bespoke operations; reflects affiliate preference for reliable income over high-risk high-reward single events.

5.5 Durability Assessment

SECTION 6 — INDICATORS AND KPIs

6.1 Health Indicators — Normal vs. Under Pressure

6.2 Disruption KPIs

6.3 Collection Methods

• Leak-site aggregation platforms (Secureworks CTU, Corvus, Mandiant, Group-IB) provide near-real-time victim posting data; this is the most reliable open-source indicator of ecosystem health.
• Blockchain forensics platforms (Chainalysis, TRM Labs, Elliptic) provide on-chain payment flow data; annual reports provide validated payment totals; real-time wallet tracking requires platform access.
• Underground forum monitoring (Intel 471, Flashpoint, Recorded Future) tracks affiliate recruitment patterns, operator reputation, and new program launches.
• Coveware quarterly ransomware marketplace reports provide victim-side data on payment rates, ransom demands, and negotiation outcomes; uniquely valuable because they reflect actual victim behavior rather than leak-site claims.
• Law-enforcement operational outcomes (FBI, NCA, Europol press releases; DOJ indictments) confirm group attribution and operational impact.

6.4 Baseline Data

6.5 Alert Thresholds

SECTION 7 — SOURCES AND CONFIDENCE

7.1 Primary Sources

Threat Intelligence and Ecosystem Reporting:

• Vectra AI — "How Ransomware as a Service Helps Attackers Scale" and "Double Extortion Ransomware" (group counts, affiliate pricing, leak-site victim statistics 2025).
• Corvus Insurance / Travelers — Q4 2024 Cyber Threat and Ransomware Statistics Report (new group formation counts, quarterly victim peak, 67% YoY group increase).
• Secureworks CTU — "State of the Threat" annual reporting (double-extortion group growth, post-ALPHV/LockBit fragmentation analysis).
• Coveware — Q1 2024 Ransomware Marketplace Report (affiliate trust degradation, "take what we can get" targeting analysis, RaaS developer credibility issues).
• ReliaQuest — "Ransomware and Cyber Extortion in Q4 2024" (affiliate migration patterns, RansomHub emergence, Scattered Spider collaboration).

Financial Intelligence:

• Chainalysis — 2025 Crypto Crime Report and associated coverage (total on-chain ransomware payments 2024: ~$813M; payment-to-demand gap; typical payment band $150k-$250k; 2023 comparison $1.25B).

Ecosystem Structure and Technical Analysis:

• IBM Security — "What is Ransomware-as-a-Service (RaaS)?" (baseline definitions, revenue model architecture, operator-affiliate separation of function).
• Arctic Wolf — "Ransomware-as-a-Service will continue to grow in 2024" (RaaS ecosystem evolution, affiliate recruitment, tooling supply).
• Menlo Security — "Ransomware-as-a-service (RaaS) kits will be a problem" (mass-market kit structure, affiliate duties, phishing-dependent access patterns).
• Wikipedia — "Ransomware as a service" (structured summary of subscription, affiliate, and license model economics).
• KnowBe4 / Coveware summaries — "Ransomware Gangs are Big Game Hunting" (median victim size increases, big-game hunting motivation).
• LinkedIn / threat-intel blogs — "How Ransomware Gangs Select Their Victims" (targeting logic, CIS filters, Cl0p campaign targeting analysis).
• NMFTA (National Motor Freight Traffic Association) — ransomware economics documentation (revenue models, affiliate split ranges).

7.2 Secondary Sources

• SC World / Secureworks — active group count during May 2024 (40 groups posting victims); 30% YoY increase in double-extortion groups.
• KnowBe4 — big-game targeting analysis and victim size data.
• Investing.com — secondary coverage of Chainalysis 2025 Crypto Crime Report financial statistics.
• DOJ press releases — LockBit (Operation Cronos), ALPHV, Hive disruption announcements; indictment details for operator attribution.
• NCA / Europol operational announcements — Operation Cronos technical details and LockBit admin deanonymization.

7.3 Gaps and Uncertainties

• Operator identity and precise location: Most operator attribution is CREDIBLE based on infrastructure analysis and forum personas; CONFIRMED identification requires law-enforcement indictment or confession.
• Affiliate pool composition: The total number and identity of active affiliates is unknown; forum monitoring captures recruitment signals but not the full affiliate roster for any platform.
• State-directive relationship: FSB protection/tolerance is CONFIRMED structural; evidence of active state tasking of commercial RaaS operators (beyond opportunistic tolerance) is CREDIBLE at best in open reporting.
• Monero payment volumes: On-chain Monero flows are substantially less transparent than Bitcoin; Chainalysis figures reflect visible Bitcoin-denominated payments and may undercount total ecosystem revenue.
• RansomHub operator identity and jurisdiction: As of April 2026, RansomHub operator identity and national base are assessed as likely Russia/CIS but not CONFIRMED in open reporting.
• Post-2025 group fragmentation trajectory: Whether the fragmentation trend stabilizes or continues is unknown; 124 groups may represent a ceiling or a continuing trend.

7.4 Confidence Notes

SECTION 8 — ANALYST ASSESSMENT

8.1 Key Takeaway

Ransomware Groups and RaaS Variants are the central aggregation function of the EDP ecosystem — not a discrete node but the mechanism by which every upstream supply chain component is monetized and every downstream cash-out channel is activated. Disrupting individual RaaS brands produces measurable short-term effects but structurally inadequate long-term impact. The 2024 ecosystem delivered 7,460-7,960 publicly named victims and approximately $813M in confirmed payments despite the two most significant law-enforcement operations in the history of the sector (Operation Cronos against LockBit; FBI against ALPHV). This outcome confirms that brand-level disruption without simultaneous pressure on the ecosystem nodes that sustain it — BPH (Node 03), IAB markets (Node 04), underground forums (Node 07), mixing services (Node 08), and OTC cash-out (Node 01) — produces affiliate diaspora, new brand formation, and ecosystem continuation at near-baseline levels.

Two countervailing trends create a narrow leverage window: total payments are declining (-35% from 2023 to 2024) while victim counts are rising (+53% YoY in 2025). This divergence indicates that the victim community is increasingly refusing to pay, which is the single most potent structural threat to operator profitability. Policies, technologies, and practices that increase non-payment rates are the highest-return disruption investment available, because they attack operator revenue without triggering ecosystem reconstitution.

8.2 Priority Recommendations

Recommendation 1 — Prioritize Payment Rail Disruption Over Brand Disruption

The declining payment-to-demand ratio (53% gap in H2 2024) reflects market forces that are more durable than law-enforcement takedowns. OFAC designation of active operator wallet clusters, combined with victim rapid-notification programs and public decryptor availability, sustains and accelerates this trend. Each designation of a payment address cluster creates compliance obligations for every exchange, OTC broker, and mixer downstream. This is Phase A and Phase B EDP playbook work (Nodes 01, 02, 08) executed in direct support of Phase C operator disruption.

Recommendation 2 — Healthcare Sector Requires Dedicated Rapid-Response Architecture

With 700+ double-extortion breaches and over 275 million patient records exposed in 2024-25, healthcare is the highest-impact vertical and a potential policy forcing function. A dedicated healthcare ransomware rapid-response capacity — combining CISA/HHS victim notification, FBI decryptor deployment, and pre-positioned technical assistance — would reduce payment rates in the highest-profile sector and generate deterrence signals to affiliates who disproportionately target it.

Recommendation 3 — Affiliate Diaspora Containment as Post-Takedown Priority

Post-Cronos and post-ALPHV experience demonstrates that affiliate migration to successor brands (primarily RansomHub) occurs within weeks. A systematic post-takedown affiliate monitoring and early-pressure protocol — targeting successor brand infrastructure before it consolidates affiliate trust — would compress the reconstitution window. This requires pre-positioned forum intelligence (Node 07) and rapid wallet cluster identification for emerging brands.

Recommendation 4 — Dark Covenant 3.0 Screening Before Individual Attribution

Any individual attribution action against Russia-based RaaS operators requires prior FSB/MVD protection-relationship screening. Attribution of a protected individual without this screening risks diplomatic friction disproportionate to enforcement value. Infrastructure and financial designation actions (Nodes 01, 02, 03, 06, 08) carry LOW backfire risk and should proceed without this constraint.

8.3 Connection to EDP Disruption Playbook

Module 07 is cross-cutting and activates all three disruption phases. The sequencing logic is:

• Phase A (Nodes 01, 02, 03 — Financial and Infrastructure Foundation): Targeting OTC brokers (Node 01), high-risk exchanges (Node 02), and BPH providers (Node 03) degrades the payment collection and infrastructure capacity of RaaS operators. Phase A disruption should precede or run concurrent with any direct operator action, as it degrades the reconstitution capability of successor groups.
• Phase B (Nodes 04, 07, 08 — Market and Trust Infrastructure): Targeting IAB markets (Node 04) degrades the access supply that affiliates depend on; targeting forums (Node 07) disrupts affiliate recruitment and brand reputation management; targeting mixing services (Node 08) intercepts payment routing. Phase B disruption is the complement to payment rail designation.
• Phase C (Nodes 05, 06, 09 — Delivery and Monetization): Targeting loader ecosystems (Node 05) degrades the delivery mechanism for ransomware payloads; targeting leak sites (Node 06) removes the double-extortion mechanism; targeting mule networks (Node 09) disrupts the final cash conversion layer. Phase C is the most operationally visible layer and should be timed to maximize psychological effect on the affiliate community.

Module 07 therefore serves as the prioritization rationale for all three phases: because operators aggregate all upstream supply chain functions and direct all downstream cash-out flows, sustained disruption of the operator layer requires concurrent pressure on all phase nodes. A single-phase approach produces temporary brand disruption; a multi-phase approach degrades the economic viability of the function.

8.4 EDP Dependency Map Update Recommendations

Note: The Dependency Map currently contains 15 nodes. These recommendations would expand it to 17. Both new nodes represent functions that are structurally central to the ransomware supply chain but are presently subsumed under the cross-cutting designation applied to Module 07. Analyst assessment confidence for these recommendations: ANALYST INFERENCE — based on cross-module analysis of all 7 completed modules and the EDP dependency mapping framework.

8.5 Follow-On Research Priorities

8.6 Module 07 Assessment Summary

The ransomware group and RaaS operator layer is simultaneously the highest-value disruption target in the EDP ecosystem and the most structurally resilient. Its resilience does not derive from technical sophistication alone but from the structural properties of the RaaS model: separation of development from deployment; a large and mobile affiliate pool; abundant replacement tooling from leaked source code; and sustained state tolerance from the Russian government. Direct brand disruption has produced measurable but temporary effects. The leverage that will produce durable ecosystem degradation lies not in defeating individual brands but in making the operator function economically unviable — through sustained payment rail pressure, victim non-payment normalization, and simultaneous disruption of the upstream supply nodes without which affiliates cannot function effectively.