Security News > 2024 > February > Ransomware Groups, Targeting Preferences, and the Access Economy
Ransomware attackers are opportunistic criminals that exploit easily accessible targets, often leveraging initial access points provided by other cybercriminals, rather than creating these access points themselves.
While we suspect many ransomware groups and affiliates directly leverage access gained through infostealers, many others choose the "White glove" service that initial access brokers offer.
Initial access brokers are a major source of supply for ransomware groups and affiliates.
More than 50 ransomware groups are known to be in operation today, with many of them offloading work to affiliates.
Competent affiliates allow a ransomware group to focus on developing increasingly sophisticated ransomware code and to perfect extortion techniques.
Established ransomware groups often compete over top affiliates, as successful ransoms of major companies can bring in hundreds of thousands of dollars within days.