How ransomware became big business
On today's International Anti-Ransomware Day, cybersecurity company SentinelOne has publishes a blog looking at on how ransomware has evolved over the past 10 years.
It highlights how Ransomware-as-a-Service (RaaS) has matured into a scalable, profit-driven model, with revenue-sharing, affiliate recruitment, and performance incentives fuelling rapid expansion across the cybercrime ecosystem.
"In ten years, RaaS has evolved from a curiosity into a global industry," says Jim Walter, senior threat researcher at SentinelOne. "The service model has lowered the barrier to entry so much that even unskilled actors can now participate. Meanwhile, the most advanced groups operate with professional polish, strong branding, and corporate-style structure. This dual dynamic, combining accessibility with professionalism, has made ransomware one of the most persistent and costly threats facing organizations today. Understanding the past decade of RaaS helps us anticipate what may come next, whether it involves new affiliate structures, more aggressive branding tactics, or the integration of emerging technologies like generative AI."
It's also a reminder of how much the ransomware threat has developed. One of the earliest significant shifts came in April 2015, when the first fully public, free RaaS platform, TOX, emerged. It allowed anyone to register, customize, and build their own Windows ransomware payloads. Although short-lived, it introduced two concepts that have since become a core part of the RaaS model: affiliate-based distribution and revenue sharing.
Walter concludes, "Global law enforcement agencies continue to discourage organizations from paying ransoms following an attack, instead advising victims to file a report with the Internet Crime Complaint Center (IC3), reinforcing broader efforts to build up cyber resilience. Defenders must continue to focus on early detection and disruption to stop attacks before they escalate. On this Anti-Ransomware Day, the best defense is awareness, preparedness, and continued vigilance."
You can read more on the SentinelOne blog.
Image credit: Benjawan Sittidech/Dreamstime.com