R is for Ransomware — When Crime Became a Subscription

The Alphabet of Harm, letter R. A modality-bridge dossier: one entry in the OSINT archive, carried forward to what our own systems catch today, closed with a verdict — ENDED, CONTINUES, or MUTATED.

Verdict: MUTATED.

The Crime That Grew a Business Model

The state letters of this alphabet keep telling one story: a capability the state once wielded in-house got spun out into a market. Surveillance became a vendor catalog (C). Espionage became a contractor's product list (I). The backdoor demand became a recurring industry (K). Letter R is that exact story told in the criminal underworld — the one place the pattern is, if anything, even more advanced.

Ransomware began as a blunt instrument: malware that encrypts your files and demands payment for the key. In its early form it was opportunistic and indiscriminate — spray it widely, lock whatever it lands on, ask a few hundred dollars, move on. That crime still exists. But over roughly a decade it professionalized into something categorically larger: a franchise economy with subscriptions, affiliates, revenue splits, customer-service portals, data-leak websites, and a payment layer engineered for anonymity. The encryption that gave the crime its name is now, in the high end of the market, almost an afterthought — one pressure lever in a data-theft-and-blackmail business.

This letter traces that mutation through the archive, and then does the honest thing our sensors allow: it shows the one part of the ransomware supply chain a homelab honeypot actually sees — not the encryption, not the leak site, but the front door, the commodity break-in that the whole franchise economy is built on top of.

1. What the Archive Holds — Four Mutations, Documented

The LSN library holds the government and industry record of ransomware's transformation, and it reads as four distinct mutations stacked on top of the original crime.

Mutation one — big-game hunting. FinCEN's 2021 Ransomware SAR analysis records the first shift: actors moved "from a high-volume opportunistic approach to a more selective methodology in choosing victims, targeting larger enterprises, and demanding bigger payouts to maximize their return on investment." Spray-and-pray became target selection. The crime started choosing victims by their ability to pay.

Mutation two — ransomware-as-a-service. The US Treasury's 2024 assessment defines the franchise in flat commercial language: RaaS is "a subscription-based model where administrators create an easy-to-use interface and then recruit affiliates to deploy attacks. Affiliates... identify targets and deploy" the payload. The operator builds and maintains the ransomware and the leak infrastructure and takes a cut; the affiliate does the breaking-in and shares the proceeds. It is a franchise, with a product, an interface, and a revenue split — the identical economic form as letter I's i-SOON and letter C's surveillance vendors.

Mutation three — double extortion. CISA's 2021 advisory documents the change that redefined the harm: criminals "increasingly coupled initial encryption of data with a secondary form of extortion, in which they threaten to publicly name affected victims and release sensitive or proprietary data exfiltrated" first. FinCEN names "double extortion schemes" outright. The leverage moved from "we locked your files" — which good backups defeat — to "we have your data and will publish it," which backups do nothing to solve.

Mutation four — the cruelty optimization. CrowdStrike's 2024 Global Threat Report shows the escalation past double extortion. One crew, VICE SPIDER, "customized the script to search for directory and filenames containing strings such as violence, abuse, Theft, Stealing, humiliation, harassment, and death, likely to identify data that posed a high potential for embarrassing victim organizations." The exfiltration is now tuned to find the most damaging material specifically, to make refusal to pay unbearable.

Method note. All four mutations are drawn verbatim from documents held in the LSN library — FinCEN, Treasury, CISA, CrowdStrike (HIGH confidence). CrowdStrike also notes, honestly, that some crews "struggled with cryptographic flaws in their ransomware that enable trivial decryption" — the industry is professionalized but not uniformly competent, and we keep that caveat rather than painting every actor as flawless.

2. Why the Data Theft Matters More Than the Lock

The single most important thing to understand about modern ransomware is that the padlock icon is a distraction. The crime's center of gravity moved from encryption to exfiltration, and the reasons are worth stating because they invert the standard defense.

For years the canonical advice was: keep good backups, and ransomware cannot hurt you — if your files are locked, restore them and refuse to pay. Double extortion was the criminal answer to exactly that advice. If your defense is backups, the attacker simply steals the data before encrypting it and threatens to publish. Now your backups restore your operations but do nothing about the fact that your customers' records, your employees' files, your unreleased plans are sitting on a criminal leak site with a countdown timer. You can be fully recovered and fully extorted at the same time.

This is why the archive's leak-site and exfiltration material matters more than the encryption. The modern ransomware operation is, functionally, a data-breach-and-blackmail business that happens to also encrypt on the way out. The encryption provides the operational disruption (pressure to move fast); the theft provides the durable leverage (pressure that backups cannot relieve). VICE SPIDER's targeting of abuse, harassment, and death filenames is the purest expression of where the leverage now lives — not in the locked files, but in the most humiliating stolen ones.

The defensive consequence is stark and under-appreciated: backups are necessary but no longer sufficient. A recovery plan that assumes the harm is denial-of-access is defending against the 2015 crime. The 2024 crime is theft, and the only defense against theft is preventing the exfiltration in the first place — which means catching the intrusion early, at the front door.

3. Who Gets Hunted — The Cruelty Is the Strategy

Big-game hunting is not just "bigger targets." The victim selection has a logic, and the logic is that the harm is deliberately pointed at the organizations whose refusal to pay costs the public the most.

FinCEN and the Treasury assessments record the concentration on hospitals, municipalities, and critical-service providers — chosen, in the archive's words, on the expectation that "the need to resume operations... may make hospitals more likely to pay a ransom." Read that carefully: the victim is selected because the disruption threatens patients, residents, essential services. The suffering of the public is not a side effect of the attack; it is the leverage. A hospital pays not only to recover its files but because every hour of downtime is a clinical risk to real people, and the attacker knows it and priced it in.

This is the moral center of letter R, and it is where the professionalization becomes genuinely monstrous. An opportunistic 2013 encryptor locking a random laptop was a nuisance. A 2024 RaaS affiliate deliberately encrypting a hospital during a patient surge, having first stolen the patient records to guarantee payment, has weaponized the public's dependence on essential services as an extortion instrument. The ROI optimization the FinCEN analysis describes, followed to its conclusion, selects for exactly this: the more a victim's failure hurts innocent third parties, the better a target they are.

The hostage and the payer are not the same party. The organization pays; the patients, the residents, the citizens are the hostages. That separation — harm the public to pressure the institution — is the strategy, not an accident of it.

Following the Money — The Rail That Makes It Worth Doing

No payment layer, no ransomware industry. Every mutation above depends on one thing: the ability to be paid, at scale, across borders, without being caught or clawed back. The archive documents that layer as carefully as the attacks, and it is the single most promising place to break the model.

The Treasury and Europol material traces the money's own evolution. Early ransoms rode premium-rate text messages and prepaid vouchers; the industry standardized on Bitcoin because it is borderless and irreversible. But Bitcoin is also a public ledger, and blockchain analytics turned that transparency against the criminals — so the sophisticated end migrated toward anonymity-enhanced cryptocurrencies like Monero, and toward chain-hopping: converting across coins and through mixers to break the trail. The FinCEN analysis was built precisely on the Suspicious Activity Reports that this money generates when it touches the regulated financial system — which is the tell. The payment must, at some point, become spendable, and the moment it re-enters the banking world it becomes visible.

That is why the payment rail is the industry's structural weak point, and why the defensive response has increasingly aimed there rather than at the malware. Sanctioning specific wallets and mixers, pressuring exchanges to enforce know-your-customer rules, seizing ransom payments mid-flight (as has happened in several high-profile cases), and making it legally hazardous to pay a sanctioned group all attack the one thing the whole franchise cannot do without: getting paid and keeping it. You do not have to decrypt a single file to bankrupt a business model whose revenue you can freeze.

This is the same lesson letter J drew about jurisdiction, applied to finance: the actor may be unreachable, but the money often is not, because money — unlike an operator in a safe haven — has to come home eventually to be useful. Attribution of the wallet feeds the sanction; the sanction feeds the seizure; and the record that makes all of it possible is exactly the kind of legible, evidenced trail this alphabet exists to build.

4. The Bridge — What Our Honeypot Actually Sees

Honesty about scope, and here it must be precise, because it would be easy to overclaim. Our honeypot does not catch ransomware. It does not see enterprise encryption, it does not see leak sites, and it does not see the extortion negotiation. Those happen against large organizations, deep inside networks we are not part of, on infrastructure that lives on the bulletproof hosts of letter J. Nothing in our telemetry is a ransomware detonation.

What our sensors do see is the commodity initial-access floor that the entire RaaS economy is built on top of. The honeypot's download telemetry:

And the payloads themselves are revealing. The dominant family is redtail, a botnet/miner loader compiled for every processor a compromised device might run — redtail.i686, redtail.x86_64, redtail.arm7, redtail.arm8 — staged alongside shell droppers (setup.sh, clean.sh) on raw.githubusercontent.com and bulletproof IPs. The 81-IP reuse of a single payload is one loader, mass-delivered, building a pool of compromised machines.

None of that is ransomware. It is a miner, a botnet, a foothold. But it is the first mile of the same supply chain. The move is identical to ransomware's opening: brute-force the SSH login (letter H), drop a loader, monetize the access. For the commodity operator, "monetize" means mining or botnet rental. For the ransomware affiliate, "monetize" means encrypting and extorting — or buying a foothold someone else already installed. Our honeypot sits at the mouth of that market.

5. The Access-Broker Economy — Our Floor Is Their Raw Material

The link between what we see and what we do not is a role the archive names implicitly: the access broker.

A RaaS affiliate does not always break in personally. A specialized market exists in which brute-forcers and loader operators sell footholds — valid credentials, an installed backdoor, a live shell on a corporate machine — to whoever will pay, ransomware crews prominently among them. This division of labor is the whole point of the franchise economy: the operator writes the ransomware, the broker sells the access, the affiliate ties them together. Each specializes; none has to be good at everything.

And the raw material of that access market is manufactured at exactly the floor our honeypot observes. The mass credential-stuffing of letter H and the relay-recruitment loop of letter O are the industrial process that produces footholds — thousands of compromised machines and cracked logins, a fraction of which get resold up the chain. The 81-IP payload reuse we logged is that process running: one loader, mass-deployed, minting an inventory of owned hosts. Not every host becomes ransomware. But the hosts that do become ransomware are minted here, at the brute-force floor, in exactly this activity, every single day.

This is the honest and useful thing a homelab can say about ransomware: we cannot see the encryption, but we can see — and help starve — the supply chain's first mile. Every credential we get hardened, every foothold that fails to install, every loader that lands in a honeypot instead of a real server, is one unit of inventory the access-broker market does not get to sell to a ransomware affiliate. Hardening the front door is not glamorous, but it is the one place a small defender materially reduces the raw material of the big-game crime.

Why the Ransom Is a Trap

The victim's decision at the moment of extortion deserves its own honest treatment, because the professionalization of ransomware has quietly made paying a worse bet than it looks, and the reasons follow directly from the mutations above.

The naive calculation is simple: pay, get the key, restore, move on. But every mutation in this letter corrodes that calculation. Under double extortion, paying buys — at most — a promise to delete the stolen data, from a criminal, with no way to verify it; the archive and the incident record are full of victims who paid and saw their data leaked or resold anyway, because the copy costs the attacker nothing to keep. Under the RaaS franchise, the affiliate you paid and the operator who holds the leak site are different parties with different incentives, so a payment to one does not bind the other. And CrowdStrike's honest note that some crews ship cryptographic flaws that enable trivial decryption cuts both ways: sometimes the files can be recovered without paying at all, and sometimes the attacker's own broken tooling corrupts the data so that paying does not restore it either.

Then there is the equilibrium. Every payment funds the next attack, trains the market that a given sector pays, and — for groups under sanctions — can itself be a legal violation by the victim. Paying is not a private transaction; it is a contribution to the industry's revenue, and the industry, per FinCEN, uses that revenue to select and attack the next hospital. The individual victim's rational-seeming choice to pay is, in aggregate, the fuel that makes big-game hunting profitable enough to continue.

None of this is a reproach to a hospital administrator staring at a countdown with patients waiting — that is an agonizing position, and this letter does not pretend otherwise. It is a statement about where the defense actually lives: not at the moment of the ransom note, when every option is bad, but far upstream, at the front door our honeypot watches — the credential, the patch, the segmented network, the offline backup, the caught intrusion. By the time the note appears, the harm is largely done. The only winning move against a franchise is to not be breached in the first place, which is exactly why the unglamorous commodity floor is where a defender's leverage is greatest.

6. What We Claim and Refuse

Precision about the evidence.

HIGH confidence: the four archive-documented mutations — big-game hunting (FinCEN), RaaS (Treasury), double extortion (CISA/FinCEN), targeted-embarrassment exfiltration (CrowdStrike) — all verbatim from library documents; the crypto payment rails (Europol/Treasury); and our own honeypot floor (245 downloads, 67 hashes, 150 IPs, redtail multi-arch loaders, 81-IP reuse).

MEDIUM / inference: the link from our commodity floor to ransomware specifically. We observe the initial-access-and-loader floor with certainty; the claim that this floor feeds the ransomware access-broker market is a well-supported structural inference, not a traced chain from a specific honeypot foothold to a specific ransomware attack. We claim the supply-chain relationship, not a particular sale.

What we do not claim: any LSN detection of a ransomware encryption event, leak site, or extortion negotiation. The modality's payload happens against targets and on infrastructure we are not part of, and we say so plainly.

What we refuse: the framing that ransomware is fundamentally an encryption problem solved by backups. That was true a decade ago and is dangerously outdated now; the modern harm is data theft and blackmail, big-game hunting of essential services, and a franchise economy that reconstitutes when any single crew is disrupted. Treating it as a malware problem rather than a business-model problem is the misunderstanding this letter exists to correct.

7. The Verdict — MUTATED

Ransomware did not end, and it did not merely persist. It transformed — more completely, perhaps, than any other letter in this alphabet — from a blunt, opportunistic file-encryptor into a full commercial industry. The archive documents every stage: big-game hunting selected the victims by their capacity to pay; ransomware-as-a-service turned the crime into a subscription franchise with affiliates and revenue splits; double extortion moved the leverage from the lock to the stolen data; the cruelty optimization tuned the theft to hunt the most humiliating material; and anonymity-enhanced crypto rails made the whole thing payable and hard to trace. The encryption that named the crime is now, at the high end, almost incidental to a data-theft-and-blackmail business.

It is the crime-world instance of the exact mutation that runs through the state letters — surveillance (C), espionage (I), the access demand (K) all professionalized from operated to productized, and ransomware did the same in the criminal economy, arguably faster and more completely. And its defense mutated accordingly: you do not beat a franchise by decrypting one payload. You beat it by denying the initial access it buys, preventing the exfiltration that is now its real weapon, and disrupting the payment rails that make it worth doing. Attack the business model, not the malware.

That is MUTATED in the fullest sense this alphabet means it: not a persistence, not an ending, but a wholesale transformation into a more resilient, more commercial, and crueler form — one whose center of gravity moved off the encryption entirely, and whose supply chain begins at the same brute-force floor our honeypot watches fill up every day.

Verdict: MUTATED — crime became a subscription, the lock became a sideshow, and the harm was pointed, deliberately, at the public whose essential services make refusal impossible.

The Alphabet of Harm is a modality-bridge series: each letter takes one entry from the OSINT archive — truth as it was recorded at the time — and carries it forward to what the LSN sensor mesh, honeypot, and web-threat telemetry catch today, then closes with a verdict. We include what the record and the vectors show. We do not judge; we let the reader judge. R is for Ransomware. Next: S.