Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Ransomware Gangs Are Now Operating Like Venture-Backed Startups
Transcript
- Lucas: So there's this idea that still lingers — that ransomware gangs are just a few guys in hoodies, typing furiously in a basement somewhere. Luna: Yeah, I think a lot of people picture the villain from a 90s movie. Maybe with a glow-in-the-dark keyboard. Lucas: Right. And that image is completely outdated. Because today, the most successful ransomware operations look less like Anonymous and more like a venture-backed SaaS startup. Seriously, they have org charts, HR, even PR teams. Luna: Wait — PR teams? As in, they issue press releases? Lucas: Exactly. Let's take the case of LockBit. This group had a public-facing blog. They had a bug bounty program — encouraging security researchers to report vulnerabilities in LockBit's own software so they could patch it and stay ahead of law enforcement. They even had an affiliate dashboard that tracked your 'sales' in real time. Luna: That's wild. So the affiliates are basically independent contractors who distribute the ransomware, and they get a cut of whatever ransom is paid? Lucas: Correct. That's the ransomware as a service model, or RaaS. The core group builds and maintains the malware, handles the infrastructure, negotiates payments. The affiliates do the dirty work of infiltration. And the split is usually somewhere around 70-30 in favor of the affiliate, because the affiliate takes the most risk. Luna: So LockBit is the platform, and the affiliates are the sales force. It's like a cyber crime franchise. Lucas: Exactly. And that franchise model scales. By 2023, LockBit claimed over 1,600 attacks against U.S. targets alone. They were hitting hospitals, school districts, manufacturing firms. And they got really good at what's called 'big game hunting' — targeting organizations that can afford to pay seven-figure ransoms. Luna: And that's where the economics get interesting. Because if you're a ransomware group, you don't want to extort a small dentist office for $5,000. You want a Fortune 500 company that might pay $2 million to get its data back and avoid a public breach. Lucas: Right. And the tactics have evolved. It's not just encrypting files anymore. Now they exfiltrate data first, then encrypt, and then threaten to leak the data publicly if you don't pay. It's called double extortion. Luna: And they put the pressure on by creating a countdown timer on a public leak site. I've seen those — it looks like a sleek product launch page, with a countdown clock and a 'data published' section. Lucas: That's exactly what LockBit did. Their leak site was clean, branded, with a Tor onion address. They even had a customer support portal for victims to negotiate. It's terrifyingly professional. Luna: So let's talk about the money trail. How much is actually flowing through these groups? Lucas: Chainalysis estimates that in 2024, ransomware payments exceeded $1 billion for the first time. And that's just what's been traced. The average ransom payment for a mid-sized enterprise is now over $800,000. And for big game hunting targets, it can be $5 million or more. Luna: And a lot of those payments are made in cryptocurrency — usually Bitcoin or Monero — which adds another layer of complexity for law enforcement. Lucas: Right. And the groups have gotten smarter about obfuscation. They use chain-hopping, mixing services, and increasingly they demand payment in privacy coins like Monero that are much harder to trace than Bitcoin. Luna: So given all this sophistication, what does effective defense look like? I mean, if these are well-funded, organized adversaries, patching software isn't enough. Lucas: It's not. The gold standard now is what's called 'assume breach' — you design your network as if an attacker is already inside. So you segment aggressively, so that even if they get into the finance department's server, they can't pivot to the manufacturing floor. You implement strong identity and access management — multi-factor authentication everywhere, not just on email. And you have a tested incident response plan that can kick in within minutes, not days. Luna: And a lot of companies are also buying cyber insurance, which often requires those controls as a condition of coverage. Lucas: Yeah, cyber insurance has become a huge driver of security spending. If you don't have multi-factor authentication and endpoint detection and response, you might not even get a quote. Or your premium is astronomical. Luna: But even with insurance, the response can be tricky. Insurers might have their own negotiators, their own criteria for whether to pay. And paying a ransom is still legally risky. Lucas: That's a great point. The U.S. government discourages ransom payments, but there's no outright ban. So companies are caught between the FBI saying 'don't pay' and the reality that without your data, you might go out of business. Luna: It's a mess. And that's why prevention is so much better than response. But prevention requires investment — in people, tools, and training. Lucas: Speaking of investment — and I'm not talking about security budgets here — this show itself is something that takes a lot of time and research to put together. We keep it ad-free because we think that's a better experience for listeners who are trying to get clear, unfiltered analysis on cybersecurity business trends. Luna: Yeah, and we really appreciate those of you who support the show directly. If you find these conversations useful for what you're building or running, you can help keep it going at buy me a coffee dot com slash fexingo. Lucas: That's buy me a coffee dot com slash fexingo. No pressure at all, but it does help us cover the hosting costs and keep things independent. Now back to the ransomware economy — because there's one more twist I want to cover. Luna: What's that? Lucas: The decryption paradox. Sometimes victims pay the ransom, get the decryption key, and it doesn't work. Or it works but the attackers still leak the data anyway because they can. There's no honor among thieves. Luna: So even if you pay, you're not guaranteed to get your data back or keep it confidential. That's a gamble with millions of dollars on the line. Lucas: Exactly. And that's why the smarter approach is to invest in resilience — backups, offline copies, and fast restore capabilities. But that also requires discipline and testing. It's not a one-time project. Luna: So the takeaway for a business leader today: ransomware groups are running sophisticated operations with real business processes. Defending against them requires a similar level of operational maturity. Lucas: Right. And understanding their business model can actually help you defend better. If you know they're incentivized to go after the highest-value targets, you can reduce your attractiveness by making sure your critical data is well-protected and your recovery time is fast. The goal is to be a hard target. Luna: And maybe to think twice before paying, given the uncertainty. Lucas: Yeah. It's a complicated landscape, but it's one where preparation really pays off. That's all for this episode. We'll be back next time with another angle on the business of cybersecurity.