Ransomware Ecosystem — Analyst Primer

Ransomware is extortion software. Attackers infiltrate an organization's network, encrypt its files or systems to make them inaccessible, and demand payment — typically in cryptocurrency — to restore access. Modern ransomware operations also steal data before encrypting it, threatening to publish it if the ransom is not paid. This is called double extortion.

What makes modern ransomware different from earlier cybercrime is its industrialization. It is no longer the work of a single criminal or small team. It is a supply chain — a network of specialized criminal service providers, each contributing a piece of the operation, connected by underground marketplaces and governance systems. Understanding that supply chain is the foundation of effective disruption.

The Scale of the Problem

Why This Is Hard

Three structural factors make ransomware uniquely difficult to suppress:

• Russian jurisdiction shield. The majority of ransomware core teams operate from Russia or CIS states. Russia does not extradite its citizens for cybercrime against Western targets, and historically tolerates — and in some cases benefits from — ransomware operations. No Russian-based core operator has been successfully extradited and prosecuted.
• Brand resilience. When a ransomware brand is disrupted, its affiliates migrate to another brand within 30-90 days. The infrastructure and relationships persist; only the brand name changes. LockBit affiliates moved to RansomHub within 60 days of Operation Cronos.
• Specialization. No single actor controls the entire chain. Disrupting one service provider creates a temporary gap that competitors fill. This is why layered, sequential disruption (Phase A/B/C) is required — not single-node action.

The ransomware ecosystem is organized into nine functional layers. Each layer contains one or more specialized criminal service markets (the 15 EDP modules). The layers are not sequential — they operate simultaneously, with criminal actors purchasing services from multiple layers at once.

Reading the Diagram

Layers are organized bottom-to-top from infrastructure foundation to financial integration. Color coding indicates the primary disruption phase. The Phase A/B/C framework determines the sequence of enforcement action — not because lower layers are attacked first operationally, but because financial disruption (Phase A) degrades the economic incentive to reconstitute when the operational layers (Phase C) are later targeted.

Step-by-Step Walkthrough

Step 1 — The Lure (Module 04)

The attack begins with a lure — typically a phishing email, malicious advertisement, or phone call designed to trick the victim into executing something. Callers and spammer operators send thousands of emails per day or staff call centers that impersonate IT helpdesks. The Scattered Spider group compromised MGM Resorts by calling the IT helpdesk and socially engineering an employee into resetting credentials — no malware required at this stage.

Step 2 — Delivery and Execution (Modules 02, 03)

If the lure involves a file or link, a loader executes on the victim machine. Before delivery, a crypter has wrapped the malware in obfuscation code to evade antivirus detection. The loader's job is to establish a foothold and download the next-stage payload.

Step 3 — Credential Harvesting (Module 01)

Once inside the network, an infostealer may run to harvest credentials, session tokens, and system information. These are sent back to attacker-controlled infrastructure. Alternatively, an IAB may have already sold access harvested from a previous infection at a different organization.

Step 4 — Access Brokering (Modules 05, 06)

In many operations, the initial access is not performed by the ransomware affiliate at all. An IAB already compromised the target and listed the access on an underground forum. The affiliate bought it. For high-value targets, an exploit broker may have provided a zero-day exploit enabling direct entry without credentials.

Step 5 — Deployment (Module 07)

The ransomware affiliate (operating under a RaaS brand) establishes persistence, escalates privileges, moves laterally across the network, and exfiltrates data before detonating the ransomware payload. This phase can take hours to weeks depending on target size and affiliate sophistication. The affiliate uses RaaS tools provided by the core team.

Step 6 — Extortion (Modules 08, 15)

Encryption is detonated. The victim receives a ransom note with payment instructions. Simultaneously, the stolen data is posted (or threatened to be posted) on the group's data leak site. The core team's negotiation team begins contact with the victim. On the defender side, professional IR firms engage to negotiate and, where possible, avoid payment entirely.

Step 7 — Payment and Obfuscation (Module 11)

If payment occurs, the victim sends cryptocurrency to attacker-controlled wallets. The funds are immediately run through mixing services to break the blockchain traceability chain. Chainalysis and TRM Labs can trace through custodial mixers with significant effort; decentralized mixers are substantially harder to trace.

Step 8 — Cash-Out (Modules 12, 13)

Mixed funds flow to OTC brokers and non-compliant exchanges for conversion to fiat currency. High-volume criminal OTC is concentrated in Russia. SUEX, Chatex, Garantex, and Cryptex have all been designated or seized. The 3-year gap between Garantex's designation (2022) and seizure (2025) demonstrates that designation without enforcement allows continued operation.

Step 9 — Integration (Module 14)

Fiat proceeds are laundered through mule networks into the legitimate economy: real estate purchases, luxury goods, shell company capitalization, and financial instruments. Over 50% of mule-linked funds exit within 1 hour. Recovery at this stage requires real-time intervention capability — post-receipt recovery is essentially impossible without it.

Understanding the financial chain is critical because financial disruption is the highest-durability lever available. Unlike operational disruption (which produces 30-90 day brand reconstitution), financial disruption raises the cost of doing business for the entire ecosystem — regardless of which brand carries the flag.

The Krysha Model

Krysha (крыша) is Russian criminal slang for "roof" — protection provided by a more powerful party in exchange for a cut or services. In the ransomware context, it describes the relationship between RaaS operators and the Russian state: the FSB is aware of ransomware operations targeting Western victims, does not enforce against them, and in some cases benefits from them through intelligence collection or plausible deniability cover for state operations.

This is not the same as the Russian state directing ransomware attacks. In most cases, it is passive tolerance: operators are left alone as long as they do not target CIS citizens or Russian state infrastructure, and cooperate when the FSB wants access to their systems or personnel.

The Extradition Reality

Russia does not extradite its citizens. This is a constitutional provision (Article 61), not a policy choice. The practical implication: any Russian national who remains inside Russia cannot be prosecuted by Western authorities, regardless of the strength of the evidence. The only viable arrest pathways are:

• Travel arrest. Operators arrested in third countries while traveling. Mikhail Vasinskyi (REvil/Kaseya) was arrested in Poland. Alexander Vinnik (BTC-e) was arrested in Greece. This requires intelligence on travel plans and coordination with transit country authorities.
• FSB-motivated domestic action. The Jan 2022 REvil arrests were politically motivated — the FSB acted after the Colonial Pipeline and Kaseya incidents generated US diplomatic pressure. The arrests were brief; members were released within months. Not a reliable enforcement mechanism.
• Defection / informant. The Conti leaks (2022) came from an embedded researcher — a human intelligence operation, not an LE action. This approach produced more disruption than any technical operation in the period.

What Works Without Russian Cooperation

The following disruption actions are fully executable within Western jurisdiction and require no Russian cooperation:

• OFAC designation of operators, OTC brokers, and exchanges — severs Western financial access
• Upstream ISP depeering of BPH providers — requires only Tier-1 carrier cooperation, not Russian state cooperation
• Tether/Circle real-time USDT freeze — requires cooperation from private stablecoin issuers, not Russia
• Non-payment advocacy and professional negotiation access scaling — operates entirely on the victim side
• Integration-stage AML enforcement (real estate, luxury goods) — entirely in Western jurisdiction
• Forum infiltration and trust manipulation — intelligence operations, not LE action requiring Russian cooperation

The Phase A/B/C framework is the operational sequencing logic for ecosystem-level disruption. It is not a chronological roadmap — phases overlap and compound. The sequencing logic is: financial disruption first because it degrades the economic incentive to reconstitute when operational pressure follows.

Why Sequence Matters

Disrupting RaaS brands (Phase C) without Phase A/B pressure produces 30-90 day reconstitution. LockBit affiliates migrated to RansomHub within 60 days of Operation Cronos. The financial and market layers reconstitute more slowly — particularly OTC and exchange infrastructure which is trust-dependent, not just technical. Applying financial pressure first means that when Phase C operational disruption occurs, the economic incentive to rebuild is lower and the cost to reconstitute is higher.

Cross-Cutting Actions (Any Phase)

• Non-payment advocacy. The single highest-durability lever requiring no Russian access. Every percentage point of non-payment rate growth at ecosystem scale represents hundreds of millions in avoided payments. 70%+ non-payment rate for professionally managed incidents vs. 35% ecosystem-wide.
• Professional negotiation access. Scaling IR firm access to SMBs and under-resourced organizations is a force-multiplier for non-payment growth. CISA/NCSC coordination is the mechanism.
• Bug bounty price parity. For exploit brokers (Module 06): when criminal prices exceed vendor bounties by 10x-100x, researchers rationally sell to criminal markets. Closing this gap reduces zero-day supply without LE action.
• Victim-side hardening. Out-of-band verification requirements for helpdesk calls eliminate the BazarCall/vishing attack surface entirely — no LE action required, no Russian cooperation needed.

Critical Statistics (2024-2025)

Key Enforcement Actions

Active Threat Actors (as of April 2026)

The 5 Most Important Things for New Analysts

• Non-payment is the most powerful lever. 70% of professionally managed incidents end without payment. Every dollar not paid is a dollar that does not flow through the entire ecosystem. Scaling professional IR access is the highest-ROI action available that requires zero Russian cooperation.
• Brand disruptions produce 30-90 day disruptions, not permanent ones. LockBit, ALPHV, Hive (except Hive) — all reconstituted or had affiliates absorbed by competing brands. The ecosystem survives brand takedowns. Phase A/B financial pressure is required to make Phase C operational disruption durable.
• The financial layer is the most important and most underexploited. The 72% victim non-payment rate in 2025 (28% paid, record low) correlates with sustained mixer and exchange enforcement. Coordinated OTC-plus-exchange designation in the same window — which has not yet been executed — remains the untested high-value action.
• Designation without physical enforcement within 12-18 months does not stop operations. Garantex is the proof of concept: designated April 2022, seized March 2025, continued processing hundreds of millions in criminal proceeds for 3 years in between. Every designated entity that remains physically operational is an open gap.
• The target is the ecosystem, not the brand. Asking "who did this attack" is less useful than asking "which nodes of the supply chain enabled this attack, and which of those are actionable." Attribution to a brand that will dissolve and reconstitute in 90 days is less valuable than infrastructure attribution that persists across brand changes.