Beyond Encryption
The Evolution of the Ransomware Business Model
Ransomware remains one of the most disruptive and persistent cyber threats facing organizations worldwide. But the business behind ransomware has changed significantly.
Today’s ransomware ecosystem is a flexible, interconnected marketplace, spanning many malware families, criminal groups, and encryption techniques, in which attackers specialize, exchange services, resell access, steal data, and pursue multiple ways to profit from a single compromise.
Beyond Encryption: The Evolution of the Ransomware Business Model examines how this ecosystem has developed since 2022, and why organizations need to look beyond the ransomware payload itself.
The intrusion itself has become the prize
The central argument of this report is that ransomware is now one monetization outcome within a broader criminal system.
Once attackers gain unauthorized access to an organization, they may pursue several revenue opportunities, including:
- Encrypting systems and demanding payment
- Stealing sensitive data for extortion
- Selling access to other criminal groups
- Harvesting credentials and business information
- Conducting fraud or supply-chain attacks
- Preserving access for future exploitation
This means the most important question is how attackers can maximize the value of a successful intrusion, not simply whether ransomware will be deployed.
Encryption remains effective because it creates immediate operational pressure, though many extortion operations no longer depend on it. Stolen data, regulatory obligations, reputational damage, and business disruption can create leverage even when systems are not encrypted.
What the report explores
This research provides a strategic assessment of the modern ransomware economy. It examines the structures, incentives, and criminal services that allow ransomware operations to adapt, looking past individual malware families or isolated campaigns.
The changing economics of ransomware
Ransomware continues to generate revenue because it combines technical disruption with pressure on business operations. The report examines why encryption remains valuable while also showing how data theft, access resale, fraud, and other forms of exploitation have expanded the potential value of a compromise.
The rise of a specialized criminal supply chain
The ransomware ecosystem has matured into a network of specialized participants. Initial access brokers, malware developers, infrastructure providers, negotiators, affiliates, and money-laundering services can each perform distinct roles.
This specialization lowers barriers to entry and allows criminal operators to obtain capabilities without building every part of an attack themselves.
How access has become a commodity
The report examines the growing importance of initial access brokers and the markets that trade compromised environments. In this model, access can be acquired, transferred, reused, and monetized independently of the ransomware payload.
For defenders, this shifts the focus toward preventing and detecting unauthorized access before it becomes a platform for multiple downstream attacks.
Extortion beyond encryption
Double extortion demonstrated that stolen data could create pressure beyond system encryption. Since then, attackers have continued to expand their use of data theft, public disclosure threats, regulatory pressure, and reputational harm.
The report considers why encryption is increasingly optional in some operations and how coercion can work even when attackers do not lock systems.
The impact of artificial intelligence
Artificial intelligence is influencing ransomware operations, mainly by supporting human operators rather than replacing them with autonomous hacking systems.
Instead, AI is helping reduce the cost of post-compromise activity, including victim triage, data processing, analysis, negotiation support, and monetization decisions. The report also considers how enterprise AI systems may become secondary targets because they organize and expose valuable corporate knowledge.
How law enforcement and regulation have shaped the market
Law enforcement operations, sanctions, cyber insurance requirements, improved security controls, and regulatory reforms have disrupted individual groups and operations.
Even so, the underlying economics of ransomware have persisted, and the ecosystem has adapted through fragmentation, cooperation, and flexible monetization strategies. The result is a more distributed criminal marketplace that is harder to disrupt by targeting a single group.
Reassessing the predictions from 2022
The report revisits the framework and predictions developed in the authors’ earlier analysis of ransomware business models.
Several structural predictions were largely validated, including:
- The continued growth of initial access brokers
- The increasing specialization of criminal roles
- The expansion of data extortion
- The growing importance of cloud environments
- The separation of intrusion from monetization
- The development of a modular criminal ecosystem
Other expectations evolved differently. Attackers retained ransomware as a core activity while adding new ways to monetize the same intrusion, rather than broadly displacing it with alternative forms of cybercrime.
This points to an important conclusion: the future of ransomware is more likely to be defined by diversification than replacement.
What this means for defenders
Measuring the threat only by the number of ransomware incidents provides an incomplete picture. An organization may be exposed to significant risk even when encryption never occurs. A successful compromise can still result in data theft, credential harvesting, access resale, fraud, supply-chain compromise, or future exploitation.
The report therefore presents a broader defensive perspective:
- Prevent unauthorized access, not only ransomware deployment
- Detect suspicious activity across the entire intrusion lifecycle
- Identify how attackers could monetize stolen access or data
- Treat exposed credentials and compromised environments as strategic risks
- Monitor cloud and enterprise AI environments for valuable information
- Prepare for extortion scenarios that do not depend on encryption
- Consider the broader criminal ecosystem when assessing ransomware risk
A strategic view of a resilient criminal marketplace
The ransomware ecosystem has endured sustained external pressure and adapted.
Its modular structure allows different participants to enter, exit, cooperate, or re-form. Criminal groups can be disrupted, but the services, markets, and incentives supporting ransomware can continue through other actors.
This adaptability is one of the report’s most important themes: ransomware is a flexible criminal economy capable of combining multiple monetization paths around a single intrusion, rather than a static business model.
Read the full report
Beyond Encryption: The Evolution of the Ransomware Business Model offers a detailed examination of how ransomware has developed since 2022 and what that evolution means for organizations, security leaders, threat researchers, and defenders.
Download the report to understand:
- Why the intrusion is increasingly the primary asset
- How access brokers and specialized criminal services shape attacks
- Why ransomware continues to persist despite disruption and pressure
- How extortion can succeed without encryption
- Where artificial intelligence is reducing attacker costs
- Why organizations should focus on unauthorized access and intrusion value
- How the ransomware economy may continue to evolve