The thing I find fascinating from a sociology perspective about ransomware is that they have to. To be a successful ransomware company, you have to simultaneously be:

1. Completely immoral enough to attack companies, hold their data ransom and potentially put them out of business and reveal the private details of thousands of people.

2. Create enough trust in the company you attacked that they believe you will give the data back once you pay them.

It is crazy that they are psychologically savvy enough to simultaneously attain those directly conflicting goals.

step 1: "join my disruptor gang and we'll protect your lifestyle/income/status in exchange for tribute, or at least not becoming a disruptee yourself."

step 2: end up eventually recapitulating the exact same system you disrupted, but now you get all the spoils of the incumbent power

There's definitely a hierarchy to it. Any particular group may not necessarily develop or own the software or infrastructure they're using. You can probably liken it to drug markets, where there are some top-level central players and many tiers below that make up the whole supply and distribution chain. (And potentially, the absolute top-level / "The Commission" may be certain elements of certain nations' governments, in some cases, or at least closely associated with them, which further complicates matters.)

You might find this 2020 interview with a ransomware operator interesting: https://talos-intelligence-site.s3.amazonaws.com/production/...

Not much capital is needed though and the affiliate and licensing model is better, which also just means an address is hardcoded that splits payment, or a server controls the private key (or master private key for infinite unique address creation) to addresses and automatically splits received payments to the RaaS service

I get that was supposed to be a joke, its exactly the same or even more streamlined than the licit economy. There is no major distinction except the kinds of “risk factors” one might list.

I would like to hear more about this, that sounds kind of hilarious. "Ah, apologies, we'll get that back to you within 3 business days. Have a nice day, I hope you had backups"

I mostly dont do ransomware housecalls anymore, but my teammates tell me the situation has mostly not improved.

They're available for their interests, not yours. They're actively robbing you and will be highly available to keep things moving efficiently, the same way physical bank robbers used to make sure staff were comfortable enough to open the safe and provide cover.

What level of support do you get for a 5 million dollar AWS budget?

A customer willingly pays to get value in return. Having your resources stolen (even with the option to choose between data or money) just makes you a victim.

$5M on AWS gets you $5M of services. If they didn't have to actually provide anything then they could have an entire team to talk to you 24hrs a day. But these comparisons are beyond ridiculous and you know it.

$5M on ransomware may have saved you either $10k or $10M on security before you had to pay out.