Cybersecurity · Appelez le tech
Forget the image of the lone hacker in a basement. Behind a ransomware attack today is a real business, with suppliers, commission-based staff, customer service and a marketplace.
A business like any other
The dominant model has a name: ransomware as a service (RaaS). It mirrors the cloud software you use every day. One group develops the ransomware and rents its platform to “subscribers,” the affiliates, who carry out the attacks. The revenue is then shared.
The result: everyone specializes, and nobody needs to know how to do everything. An affiliate doesn’t need to write code; a developer doesn’t need to break into victims personally.
The org chart of an attack
Surprisingly, it’s the affiliate, not the developer, who takes the biggest share. Operators compete to recruit the best ones. In May 2026, a new program was recruiting on criminal forums by promising affiliates 90% of the revenue, in language worthy of a job posting.
The dark web, the marketplace
The dark web refers to networks such as Tor, reachable with special software, where server locations and user identities are hidden. It isn’t illegal in itself, but it hosts the markets where this ecosystem does business, complete with storefronts, seller ratings and escrow services.
What’s for sale there includes:
- access to corporate networks: VPN, remote desktop, compromised Microsoft 365 accounts;
- stealer logs: passwords and session tokens siphoned from an infected computer, sometimes enough to bypass multi-factor authentication;
- stolen data, tools and services: ransomware, phishing kits, hosting.
Law enforcement scores real wins, such as the LockBit takedown in 2024. But when one infrastructure falls, affiliates simply rebrand. So you can’t count on the police to make the threat go away.
The ambiguous role of insurers
Cyber insurance has become a central player. During an attack, the victim calls its insurer’s emergency line, which brings in approved vendors: a specialized lawyer, digital forensic investigators, sometimes a professional negotiator. Insurers have also pushed SMBs to improve their security by requiring multi-factor authentication, backups and detection tools.
The perverse effect: during reconnaissance, attackers look for your insurance policy so they can set the ransom just below your coverage limit. Some openly cite it during negotiations. Keep it, along with your financial statements, off your shared network drive.
The good news: fewer and fewer victims pay. According to Coveware, the share fell from 85% in early 2019 to about 23% in 2025-2026. And paying to have stolen data “deleted” offers practically no guarantee.
Breaking the chain, link by link
Since the attack is a chain of specialists, every link is an opportunity to stop it.
| Criminal link | Control that breaks it |
|---|---|
| Access broker | Multi-factor authentication everywhere, no exposed remote desktop, up-to-date VPN |
| Stealer logs | Detection on every computer, no personal use of work computers |
| Affiliate inside the network | Least privilege, separate admin accounts, segmentation |
| Encryption | Immutable, offline and tested backups |
| Extortion | Written response plan, insurance policy kept off the network |
Hit by an attack? Report it
The Canadian Centre for Cyber Security estimates that most attacks against Canadian victims are never reported. Yet every report helps prevent more victims:
- your local police service;
- the Canadian Anti-Fraud Centre;
- the Canadian Centre for Cyber Security (My Cyber Portal or contact@cyber.gc.ca);
- in Quebec, the Commission d’accès à l’information if personal information is involved (Law 25).
Want to know which links are weak in your business?
Appelez le tech · 1 833 444-1041