Understanding the economics behind ransomware explains behaviour that otherwise looks arbitrary: why small businesses are hit, why ransom demands vary so widely, and why paying frequently does not end the matter.

It is a service industry

Core groups develop the malware, run the payment infrastructure, and operate the leak sites. They recruit affiliates who carry out intrusions and take a percentage. Separate specialists sell initial access. This division of labour means the person inside your network may have no involvement with the malware's authors, and turnover among affiliates is high.

How targets are chosen

Mostly opportunistically. Affiliates scan for exposed remote access, unpatched internet-facing systems, and buy credential sets. Selection is driven by ease of access and apparent ability to pay, not by sector prestige. A small business with an exposed remote desktop is a more attractive target than a hardened enterprise, which is why "we are too small to be a target" is consistently wrong.

The sequence inside a compromise

  • Initial access via stolen credentials, an exposed service, or phishing.
  • A period of quiet reconnaissance — frequently days or weeks — mapping systems and finding backups.
  • Privilege escalation and lateral movement to gain broad administrative control.
  • Data theft, before anything is encrypted.
  • Backup destruction or encryption, deliberately, to remove your alternatives.
  • Encryption, usually timed for a weekend or holiday when response is slowest.

Why backups alone do not resolve it

Because data was taken first. Even with a clean restore, the group holds your files and will threaten publication on a leak site, contact your customers, or notify regulators. This is double extortion, and it is why a purely technical recovery plan is insufficient — the incident has a disclosure and communications dimension regardless of how good your backups are.

What this means for defence

The controls that matter are the ones addressing the sequence above: remove internet-exposed management interfaces, phishing-resistant MFA on remote access and email, backups that are offline or immutable, limits on lateral movement, and logging good enough to detect the quiet reconnaissance phase. None of that is exotic, and it is where nearly every prevented incident is prevented.