How Ransomware Gangs Work as a Business

The groups that show up in headlines are often brands, not gangs in the street sense. An operator writes the encryptor, hosts a leak site and a negotiation panel, and takes a cut. Affiliates buy or steal access, deploy the payload, and take the rest. That split — ransomware-as-a-service — is why names vanish after a raid and reappear with a new coat of paint two months later. The dark web is the storefront and the shame channel, not the malware itself.

Operators, affiliates, and the cut

A typical RaaS panel gives an affiliate a builder, a unique build ID, and a victim chat URL. The affiliate handles intrusion and detonation. The operator handles payment infrastructure, data hosting and the public leak blog. Public reporting on LockBit, Conti and others has put the affiliate share in a wide band (often described as most of the ransom, with the operator keeping a minority). Treat any exact percentage you see in a slide deck as specific to that panel and that year.

Initial access is frequently purchased, not invented. Initial access brokers sell RDP, VPN and stolen-cookie sessions in the same forum economy as stolen data after a breach. A hospital incident may start with a $10 stealer log and end with a seven-figure demand. The people who wrote the encryptor never touched the first phishing mail.

Colonial Pipeline / DarkSide in 2021 is the incident most readers already know; this site mentions it on the risks overview. The pattern to keep is the franchise: DarkSide was a brand with affiliates. After the political heat, the brand shut down. The people and the playbook did not.

Double and triple extortion

Encryption alone is a weak lever against a shop with backups. The current default is:

1. Steal a pile of files first.
2. Encrypt the rest.
3. Threaten to publish the steal on a dedicated leak site if nobody pays.
4. Sometimes call the victim's customers, regulators or the press — "triple" in vendor jargon.

The leak site is why these crews need the dark web. Tor onion blogs are hard to take down quickly, easy to screenshot into the mainstream press, and they double as advertising for the next affiliate. Negotiation portals are usually onions as well: a unique path per victim, a countdown, a Bitcoin or Monero address.

Paying does not guarantee deletion. Crews have published after payment; they have also recycled the same dump in a later brand. There is no contract, and no court you want to name as the venue.

What takedowns actually do

Operation Cronos (February 2024) is the case to study. An international action led in Europe, with US and UK partners, seized LockBit infrastructure, published a victim-decryptor story, and used the gang's own site to mock the operators. The US later unsealed charges and sanctions against named LockBit figures, including the person prosecutors identified as the administrator.

What followed is the RaaS lifecycle: affiliates scattered, some decryptors went out, copycat brands and "LockBit revived" onion sites appeared, and other panels absorbed the displaced labor. The encryptor market did not close. A brand took a public loss.

Operation Endgame (2024–2025, several waves) went after the droppers and stealers underneath — the loaders that turn a phishing click into an access sale. Europol's public updates described large server counts and credential troves. That is the supply chain, not a single logo. If you only watch group names, you miss the access brokers who never put a brand on a leak site.

Money, and why Monero shows up

Chainalysis and other analytics firms still see a lot of ransomware cash-out on Bitcoin because that is the chain they can cluster. Their year-end notes through 2024 described ransomware as a smaller share of all crypto-crime than theft from services, but still hundreds of millions in observed payments in peak years. Those figures are lower bounds: they count what hits addresses the firms have tagged.

Monero appears in more panels because the public graph is weaker; see Bitcoin vs Monero. Exchanges remain the weak point either way. A crew that demands "untraceable coin" and then sells it to a KYC book has only moved the identification problem by one hop.

Law enforcement operations against markets and against ransomware overlap in method: follow the cash-out, run the panel as a honeypot after seizure, publish the keys you can.

What defenders and victims can actually use

• Assume double extortion. Backups without an isolation story do not answer a leak threat.
• The first 24 hours are for counsel, insurer, and a forensics shop that will not pay on your behalf without a decision. Law enforcement in the US and UK wants the complaint even if you will not pay; they also collect panel URLs and wallet clusters.
• Do not run random "decryptor" binaries from a forum. Official repositories (No More Ransom and national CERTs) are the path that does not add a second payload.
• Stolen files that appear on a leak blog cannot be pulled back. Treat publication as a data-breach event: notify, rotate, monitor. The consumer version of that work is on checking whether your data is circulating.
• Access hygiene — phishing-resistant MFA, no exposed RDP — is more decisive than any brand-specific IOC you will read in a flashy report.

This is awareness, not incident response. A live event needs people who will look at your logs.

Frequently Asked Questions

What is ransomware-as-a-service?

An operator provides the encryptor, the leak site and the payment stack. Affiliates compromise victims and deploy the build. Revenue is split. The brand can die in a raid while the affiliate moves to another panel the following week.

Did Operation Cronos end LockBit?

It seized infrastructure, embarrassed the brand, and produced charges. It did not end ransomware, and it did not permanently remove every affiliate. Successor sites and other RaaS panels absorbed the work.

If we pay, will they delete the data?

There is no enforceable promise. Some crews stay quiet after payment; some publish anyway; some resell the access. Payment also does not make the crime legal or guarantee a working decryptor.

Why do leak sites stay online?

They are onion services, often mirrored, and the operators treat the blog as marketing. Domain seizures work on clearnet frontends. The shame copy gets screenshotted before the mirror dies.