Follow the Money · 18 — The Franchise: Ransomware as a Business

Follow the Money — Case 18. This register follows illicit value from the keyboard to its final resting place, and closes on the money's disposition: LAUNDERED · RECOVERED · FROZEN · CONVERTED · VANISHED · SPENT.

Case 01 followed a single ransom through the six-step laundering machine. This case follows the whole business that produced it — because ransomware, over the past decade, stopped being a crime and became an industry, with a supply chain, a division of labor, brand names, revenue splits, customer support, and a professional-services sector orbiting it. The model has a name that sounds like a legitimate startup pitch: ransomware-as-a-service, RaaS. And once you see it as a business, the disposition of the money changes shape. The ransom is not a treasure a criminal buries. It is the operating revenue of a franchise, and it is spent to run the franchise.

The maturation shows even in the language the regulators use. FinCEN describes ransomware actors shifting from a high-volume opportunistic approach to a more selective methodology, targeting larger enterprises and demanding bigger payouts to maximize their return on investment, and diversifying their revenue streams through RaaS. Return on investment. Revenue streams. Business model. This is not the vocabulary of a lone hacker; it is the vocabulary of an industry, and it is accurate. Modern ransomware has developers who build the product, affiliates who deploy it, brokers who supply the raw material of network access, negotiators who haggle the price, launderers who wash the proceeds, and a customer-facing extortion operation with leak sites and support chat. It is a franchise, and this letter follows the money across every role in it.

The disposition is SPENT — but not spent the way Case 02's warhead was spent or Case 08's contraband was bought. It is spent the way any business spends its revenue: paying the staff, buying the inputs, funding development, and financing expansion. The ransom becomes the operating capital of a criminal enterprise, which is the single most important fact about why ransomware will not go away. You can arrest a crew and the industry survives, because the money does not fund a person. It funds a machine that builds the next person.

1. The Franchise Model

Start with the structure, because the structure is the whole insight. The US Treasury's 2024 assessment describes RaaS precisely: a subscription-based model where administrators create an easy-to-use interface and then recruit affiliates to deploy attacks, with the affiliates identifying targets and deploying the malware and sharing the proceeds with the administrators. Read that as a franchise agreement, because that is exactly what it is. The administrators are the franchisor: they own the brand, build the product, run the infrastructure, and provide the tools and support. The affiliates are the franchisees: they operate locally, do the actual attacking, and pay the franchisor a cut of the take.

The genius of the model, from the criminal's perspective, is the division of labor, and FinCEN's advisory names its core mechanism: through RaaS, developers sell or deliver ransomware to individuals or groups that have separately gained illicit access to a victim network, letting cybercriminals of varying skill levels monetize their illicit access. That phrase — of varying skill levels — is the key to the industry's scale. In the old model, a ransomware attacker had to do everything: find a vulnerability, breach the network, move through it, write or acquire the ransomware, deploy it, handle the payment, and launder the proceeds. That is a rare combination of skills, and rare skills limit an industry's size. RaaS shattered that requirement into specialties. Now you can be brilliant at breaking into networks and terrible at everything else, and still profit — by selling your access to someone else. You can be a mediocre operator and still run devastating attacks, because the developers hand you a polished, effective weapon and a support desk. The barrier to entry collapsed, and the population of people who could participate exploded.

And upstream of the affiliates sits the supply chain, the part the register finds most industrially telling. The Treasury's DeFi assessment documents it: cybercriminals use RDP endpoints and phishing to harvest credentials and gain access, and ransomware actors share resources like exploit kits or form partnerships. This is the initial-access-broker economy — specialists who breach networks and then sell that access, as a commodity, to the affiliates who will deploy the ransomware. The single hardest part of a ransomware attack, getting in, has become a product you can buy on a market. That is what an industry looks like: not one criminal doing a whole crime, but a chain of specialists each doing one step and selling their output to the next. The franchise did not just organize the attackers. It built them a supply chain.

2. Product Development: Double Extortion

Businesses improve their products, and the ransomware franchise is no exception — its central product innovation is one of the most consequential and cruel developments in the whole field, and it exists because the defenders got good. For years, the best defense against ransomware was simple and effective: keep good backups. If your files are encrypted but you have clean copies, you restore from backup, refuse to pay, and the attacker gets nothing. As backups improved and organizations learned the lesson, the encryption-only model started to fail — victims stopped paying because they did not have to.

So the franchise developed a new product, and CISA documented it: cyber criminals increasingly couple the initial encryption of data with a secondary form of extortion, threatening to publicly name affected victims and release sensitive or proprietary data exfiltrated before the encryption. This is double extortion, and it is a deliberate defeat of the backup defense. Before locking your files, the attacker steals a copy of them. Now, even if you restore perfectly from backup, they hold a second threat that backups cannot cure: pay, or we publish your customers' data, your patients' records, your employees' secrets, your intellectual property, on a public leak site for the world and the regulators to see. A backup restores your operations; it does not un-leak your data. Some operations went further to triple extortion, adding distributed-denial-of-service attacks to knock you offline during negotiations, or directly harassing your customers and partners to pile on pressure.

The register frames this as product development because that framing is what reveals the industry's nature. A lone criminal does not iterate on a business model in response to defensive countermeasures; a business does. The move from encryption to double to triple extortion is a product roadmap, driven by exactly the competitive logic that drives legitimate software: the defenders shipped a countermeasure (backups), so the attackers shipped a feature that made the countermeasure irrelevant (data theft and the leak threat). And each iteration raised the share of victims who pay, which is the metric the whole franchise optimizes. The cruelty is real and the register never loses sight of it — the 'feature' is the threat to expose a hospital's patients or a company's employees — but the cruelty is engineered, roadmapped, and shipped like a product, because that is what ransomware has become.

3. Choosing the Victims

An industry optimized for revenue chooses its customers — or rather its victims — strategically, and the strategy of the ransomware franchise is one of the darkest facts in the register, because it optimizes for coercion. The Treasury's 2022 assessment documents the pattern: attacks on small municipalities and healthcare institutions became more common, likely on the expectation that the need to resume operations, especially during a pandemic, would make hospitals more likely to pay. Read the logic coldly, the way the franchise does: the ideal victim is not the richest target but the one least able to tolerate downtime, because that victim has the least ability to refuse.

This is why ransomware disproportionately hits hospitals, schools, and local governments — institutions that are not wealthy but are critical, where the systems being locked are not a convenience but a lifeline. A hospital with encrypted systems cannot access patient records, schedule surgeries, or run equipment; the pressure to pay is not financial but human, measured in patients who cannot be treated. A city with locked systems cannot run its services, process its payments, or dispatch its responders. A school cannot function. The franchise selects these targets precisely because the coercive leverage is maximal — because an institution that literally cannot operate while down will pay to operate again, and pay fast. The victim's essentialness to the public is not a deterrent to the attacker; it is the selection criterion.

The register centers this because it is where the business abstraction meets its human cost, and the two must be held together. It is analytically true that ransomware is an industry with a supply chain and a product roadmap and a revenue model — and it is morally essential to remember that the 'revenue model' runs on the disruption of cancer treatments, the paralysis of 911 systems, the exposure of abuse survivors' records, the shutdown of schools. The franchise framing is not a way of making ransomware sound clever or clean; it is a way of understanding why it is so effective and so persistent, so that the response can match the machine. But the machine's output is measured, at the far end, in patients and residents and children whose institutions were attacked because they could not afford to say no. The victims are chosen for their vulnerability, and the register will not let the business language obscure that the business is the deliberate infliction of harm on the people least able to absorb it.

4. Where the Money Goes: The Enterprise Itself

Now the disposition, because following the money through the franchise reveals why the word SPENT means something specific here. When a ransom is paid, it does not go into a single criminal's wallet to be hoarded. It is split, immediately, according to the franchise's economics, and then it is spent running and growing the business. This is the fact that governs everything about ransomware's persistence.

Trace the split. The affiliate who ran the attack takes the majority share — often the large majority — for doing the operational work. The developer-administrators take their percentage for supplying the ransomware, the infrastructure, and the brand. If an initial-access broker supplied the way in, they were paid for the access, upstream. Launderers take a cut for washing the proceeds through the machinery of Case 01. Negotiators and support staff are paid. And then the retained revenue — the franchise's profit — is reinvested exactly as a business reinvests: funding continued development of the ransomware (better encryption, better evasion, the next extortion feature), buying more network access from brokers to feed the next wave of attacks, recruiting and equipping more affiliates, and expanding the operation. The ransom becomes operating capital, and the operating capital funds the production of more ransomware attacks. The money is SPENT — on the enterprise itself.

This is the register's central strategic finding about Case 18, and it explains the frustration of a decade of ransomware enforcement. Law enforcement disrupts a ransomware crew — seizes infrastructure, arrests operators, sanctions a group — and the industry barely flinches, because the money never funded that crew as an endpoint; it funded the ecosystem that produces crews. Take down one affiliate and the developers recruit ten more, because the model is designed to be resilient to the loss of any node. Sanction one RaaS brand and it rebrands, its developers and affiliates dispersing into new franchises, exactly the pattern the actor register documented across the ransomware economy. The reason ransomware persists as an industry even as individual groups are repeatedly disrupted is that the disposition of the money is the industry: every ransom paid is not just a loss to a victim but an investment in the machine, capital that funds the next attack, the next affiliate, the next feature, the next victim. Following a single ransom misses the point. The money's final resting place is the enterprise, and the enterprise is built to outlive any of its parts.

5. The Insurance Question

There is one more player in the ecosystem, and it is the most contested, so the register handles it with care: the professional sector of negotiators, incident responders, and cyber-insurers that has grown up around ransomware. That this sector exists at all is itself evidence of the industry's maturation — the Sophos and Verizon reports track ransom-payment statistics drawn substantially from ransomware negotiators, a professional class that did not exist for a crime but does for an industry. Crimes do not have a professional-services sector. Industries do, on both sides.

And here the register presents a genuine, unresolved debate rather than a verdict, because the honest position is that reasonable, serious people disagree. Cyber-insurance is, in many respects, a real good: it funds recovery, incident response, forensic investigation, and — increasingly — the security improvements insurers require as a condition of coverage, which push the whole market toward better defenses. But critics, including voices in government, argue it can also create a perverse feedback loop. The argument runs: when an insurance policy will reimburse a ransom, paying becomes the path of least resistance for the victim — cheaper and faster than a painful rebuild — so more victims pay; and a higher payment rate makes ransomware more profitable, which funds more attacks, which produces more victims. In this view, the insurance intended to protect against ransomware helps sustain the market it insures against, subsidizing the franchise's revenue with premium dollars.

The register does not resolve this, because it genuinely is not resolved. The feedback-loop argument is plausible and is made by serious people; it is also contested by insurers who point to their role in raising defensive standards and to the fact that they increasingly discourage or refuse to fund ransom payments, and by the reality that the payment decision has many drivers besides insurance. What the register can say is narrower and defensible: a mature negotiation-and-insurance ecosystem exists, it materially shapes the payment decisions on which the franchise's revenue depends, and the question of whether it dampens or feeds the industry is one of the most consequential open debates in the field. The register flags it as exactly that — an open, important debate about a genuine tension — and declines to pretend to a certainty the evidence does not yet support. It is enough, for a register about following the money, to note that the money's path runs partly through an insurance market, and that whether that market is a firebreak or an accelerant is not yet settled.

6. The counter-narrative, steelmanned

The strongest objection to this letter is that the 'franchise' and 'business' framing dignifies and even glamorizes what is, at bottom, extortion, and it deserves a fair hearing.

The argument runs like this. Describing ransomware with the vocabulary of legitimate enterprise — supply chains, product roadmaps, revenue models, professional services — makes it sound impressive, even admirable, and risks aestheticizing a crime whose actual content is threatening hospitals and stealing patients' records; the register should call it what it is, coercion and theft, not narrate it like a Harvard case study. Worse, the objection continues, the business framing can slide toward fatalism: if ransomware is a resilient 'industry' whose money funds an unkillable 'machine,' the implication is that enforcement is futile, which both demoralizes defenders and lets governments off the hook for failing to disrupt the actual havens where these operators live. And the insurance section, the argument concludes, is a cop-out — hiding behind 'it's a genuine debate' when the register should take a position.

The register grants the force of all of it and holds its ground. Yes, the business language risks glamorizing, which is exactly why Section 3 exists — to drive the analysis straight into the human cost, the hospitals and patients and children, and to say explicitly that the franchise framing is a tool for understanding effectiveness, not a compliment; the register calls the product 'the threat to expose a hospital's patients,' not a clever feature, and never lets the vocabulary launder the cruelty. Yes, the resilience finding could read as fatalism — but the register's point is the opposite of futility: understanding that the money funds the ecosystem, not the crew, is precisely what tells defenders and governments where to actually strike (the money, the access-broker market, the havens, the cash-out), rather than mistaking the arrest of one crew for a win, which is the real path to demoralization. And on insurance, the register takes the position that the honest position is uncertainty — pretending to a settled verdict the evidence does not support would be the failure, not the refusal to fake one; naming a genuine, consequential, unresolved debate as unresolved is forensic discipline, not evasion. What the register will not concede is that seeing ransomware clearly as an industry is the same as admiring it. The opposite is true: you defeat a machine by understanding how it is built, and the franchise framing is the blueprint of the thing that has to be broken — followed, as always, by the money.

7. Disposition — SPENT

Case 18 followed the money through the whole business of ransomware — the developers who build and rent the weapon, the affiliates who wield it, the brokers who sell the way in, the negotiators who set the price, the launderers who wash the take, and the insurers and responders who orbit it all. It is a franchise: specialized roles, a supply chain, a product roadmap of ever-crueler extortion, a victim-selection strategy optimized for coercion, and a revenue model that splits every ransom across the enterprise. The ransom is not a hoard. It is operating capital.

The disposition — the money's fate — is SPENT. Not on a warhead, not on contraband, but on the enterprise itself: split by percentage among the roles, and reinvested into development, access, recruitment, and the next wave of attacks. This is the register's most structurally important SPENT, because it explains ransomware's permanence. Every ransom paid is an investment in the machine — capital that funds the initial-access market, pays the affiliates, improves the product, and finances the attack that comes after. That is why disrupting a single crew barely dents the industry: the money never funded the crew as an endpoint; it funded the ecosystem that produces crews, and the ecosystem is built to survive the loss of any part.

Hold the two truths this case will not let go of. Ransomware is, analytically, an industry — a franchise with a supply chain and a roadmap, understood best in the cold vocabulary of business, because that is what it has become. And the product of that industry is the deliberate infliction of harm on the institutions society can least afford to lose — the hospital that cannot treat patients, the city that cannot run services, the school that cannot open — chosen precisely because they cannot afford to say no. The honeypot beneath these words logs the affiliates' reconnaissance, the brokers' probes, the first knock at the door; the money is what happens after they get in, split across a business and spent to fund the next intrusion. The vectors do not lie: the ransom was paid, the revenue was shared, and the profit bought the next attack. Judge the franchise — the developers who own the brand, the affiliates who wield it, the brokers who supply it. Then hold the register's hard finding: that the money's resting place is the enterprise itself, that every ransom is a reinvestment in the machine, and that ransomware persists not because any crew is unbeatable but because the money is spent building the crew that comes next.

Follow the Money continues. Case 18 disposition: SPENT. Confidence: HIGH on the documented facts — the RaaS franchise/subscription model, the developer-affiliate profit split, the shift to big-game hunting and ROI framing, and the initial-access-broker/exploit-kit supply chain are stated in FinCEN's ransomware advisory and SAR analysis, the US Treasury 2024 and 2022 risk assessments, and the DeFi risk assessment; double/triple extortion and critical-service targeting are documented by CISA and the Treasury assessments; the negotiation economy and payment statistics are from Sophos's State of Ransomware and the Verizon DBIR. The cyber-insurance feedback-loop point is explicitly presented as a genuine, unresolved, contested debate, not a settled finding. The reinvestment-into-the-enterprise disposition is argued as analysis grounded in the documented economics. Victims (hospitals, municipalities, schools) are centered; the ransomware operators are the perpetrators. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the franchise, the revenue model, and the money spent to build the next attack.