Extortion and the RaaS Ecosystem

• Single extortion: encrypt, demand payment for the decryptor.
• Double extortion: steal data first, then encrypt — pay or we leak it. Defeats "we have backups."
• Triple/quadruple extortion adds DDoS, harassing victims' customers, regulatory threats.
• RaaS (Ransomware-as-a-Service): a criminal business model.
• Operators build/maintain the ransomware and leak site.
• Affiliates break in and deploy it, splitting profits (often 70/30).
• Initial Access Brokers sell footholds into victim networks.
• Consequence: attacks are specialized and industrialized, not lone-hacker jobs.