Tech is advancing. We have AI innovations everywhere, but many people don't realize that ransomware has grown into a multi-billion-dollar global criminal industry.
Billion-dollar industry? Of course. I'm talking about:
• Total ransom payments made by victims • The broader cybercrime economy, such as brokers, malware developers, etc. • Recovery costs, downtime, insurance payouts, and legal costs
And modern ransomware isn't just the work of lone hackers. It operates like an organized business network.
For instance: • Ransomware-as-a-Service (RaaS) groups sell tools to affiliates • Then affiliates breach companies and deploy ransomware • And profits are split, maybe 70/30, just like a franchise model
This whole thing is disturbingly similar to a SaaS business model.
Even though ransom payments fluctuate from year to year (due to police action, cryptocurrency tracking, and global political changes), the overall ecosystem, including blackmail, data leaks, and double extortion, clearly operates on a billion-dollar scale.
Guess what? The money paid to hackers is just a small part of the total cost of a ransomware attack. The bigger financial damage usually comes from fixing the problem. I'm talking about restoring systems, losing business while operations are down, and rebuilding affected technology.
How Ransomware Operations Work
Modern ransomware operations run like structured criminal businesses.
Initial Access: They target organizations with weak security or exposed remote access.
Exploration: Once inside, they move laterally across systems, steal admin credentials, map backups, and identify valuable data. This phase can last days or weeks.
Data Theft (Double Extortion Setup): Before encrypting anything, they:
- Steal sensitive files (HR, financials, customer records)
- Exfiltrate gigabytes or terabytes of data
This allows them to threaten public release later if the ransom isn't paid.
Encryption: They deploy ransomware that encrypts servers and workstations, disables backups, and leaves ransom notes everywhere.
Extortion: Ransom demands are usually in cryptocurrency. Modern tactics include:
- Double extortion: "Pay or we leak your data."
- Triple extortion: Pressure customers or partners too
- Public "leak sites" to shame victims
Payment Laundering: Victims who pay send cryptocurrency. Criminals then move funds through mixers, use permissive exchanges, and convert them into cash or assets.
They have structured, repeatable, scalable plans.
Who Gets Targeted?
Today, individuals are far less profitable targets.
Older ransomware (2016–2018) often targeted home users. But now:
- Average individual payout = small
- Law enforcement attention = higher
- Crypto tracing = stronger
Most criminals now focus on companies rather than random consumers, except perhaps the wealthy or those with a luxury lifestyle.
Individuals are more commonly hit with scams, account takeovers, identity theft, etc., rather than large ransomware demands.
What Actually Stops Ransomware?
The truth is, there is no single magic tool that "stops ransomware." But from my experience as a consultant, a basic formula I usually recommend is:
Strong backups + MFA + Patch management + Limited admin rights + Monitoring & EDR + Incident response plan + Red Team testing
Each component plays a critical role: backups mitigate leverage, MFA blocks initial access, patching closes vulnerabilities, monitoring & EDR detect attacks, and Red Team testing validates defenses.
For those who want to dig deeper, I highly recommend downloading The Law of Human Hackability. It's 100% free: bit.ly/TLOH
Thank you for reading!
Connect with me:
Email: timsuxwales@gmail.com Instagram: @ timsuxwales Substack: https://timsuxwales.substack.com/ Speak to a cybersecurity consultant: bit.ly/cyconsult