Ransomware’s Affiliate Economy: Fragmented, Resilient, and Relentless

In 2025, ransomware is less a single product and more an ecosystem of services, partnerships, and shifting allegiances. At the heart of this economy lies the affiliate model, a business structure that has allowed ransomware to scale globally, impact organizations in more than 109 countries, and make groups like CL0P, AKIRA, QILIN, and Rhysida household names in cybersecurity circles.

The Scale of Affiliate-Driven Attacks

Data from the first half of 2025 shows just how pervasive the affiliate system remains:

• Thousands of breach claims tied to 90 distinct ransomware groups.
• Victims spanning sectors from services and manufacturing to IT/communications and retail/wholesale.
• Disruptions affecting not only private enterprises but also cultural and public institutions.

The impact is more than financial. It strikes at the core of business continuity and public trust. Consider the British Library attack by Rhysida affiliates in late 2023: services were thrown back to “pen-and-paper” operations, digital access remained impaired well into 2025, and only in July 2025 was full service finally restored. Despite refusing to pay a £600,000 ransom, the library’s long disruption shows just how crippling affiliate-driven operations can be.

How Affiliate Programs Work

At their core, Ransomware-as-a-Service (RaaS) models mimic legitimate software subscription programs. Developers build the tools, then rent them out to affiliates who carry out attacks and split the profits. But unlike corporate partnerships, these relationships are:

• Pseudo-anonymous: agreed through encrypted chat rooms and dark web forums.
• Low-barrier to entry: some groups charge a nominal “membership” fee (LockBit’s notorious $777 recruitment campaign is a prime example).
• Portable: affiliates can defect, rebrand, or join new groups as takedowns occur.

This means that when law enforcement disrupts a major group, the affiliates don’t disappear, they migrate. They bring with them intrusion skills, access to stolen data, and sometimes even decryption tools from their former “employer.”

The LockBit Case Study: Fragmentation in Real Time

The saga of LockBit illustrates just how fluid the affiliate system can be:

• 2024 takedown: Law enforcement targeted the group’s infrastructure, disrupting operations.
• Rapid reemergence: By December 2024, LockBit rebranded as “LockBit 4.0” and began recruiting new affiliates. By February 2025, “LockBit 5.0” was released.
• Affiliate scramble: Some affiliates quickly joined the reboot, while others hedged bets with multiple groups.
• May 2025 leak: An unknown attacker (“xoxo from Prague”) compromised LockBit again, exposing a SQL database that revealed chaotic operations, including 156 victims and evidence of poor key management.

The leaked data underscored the dangerous truth that even affiliates themselves cannot guarantee outcomes. Victims negotiating with LockBit affiliates had no certainty that the affiliate held the right decryption keys, or that stolen data wouldn’t be repurposed or leaked elsewhere.

Why Affiliates Make Ransomware So Hard to Eradicate

Affiliate networks explain why ransomware continues to thrive despite repeated takedowns of major groups:

• Resilience through decentralization: When one group collapses, its affiliates scatter and rejoin others, keeping the ecosystem alive.
• Continuous innovation: Affiliates bring battle-tested intrusion tactics with them, spreading technical knowledge across groups.
• Overlapping allegiances: Affiliates often work with multiple groups simultaneously, complicating attribution and inflating the scale of impact.

In effect, law enforcement may chop down a tree, but the forest remains.

Why Paying Affiliates Is Even Riskier

Ransomware payments are always risky, but with affiliates, the danger multiplies:

• Unclear ownership of keys: Victims may pay an affiliate who lacks control of the decryption tool.
• No guarantee of data deletion: Affiliates may share or resell stolen data, even if a ransom is paid.
• Duplicate extortion attempts: Multiple groups may claim ownership of the same data, leading to second or third ransom demands.

The LockBit database leak highlighted these realities, showing that affiliates routinely misrepresented their control and often juggled negotiations across different groups.

Preparing for an Affiliate-Driven Threat Landscape

As affiliate programs continue to fragment and evolve, organizations should adjust their expectations: ransomware is not going away, but the structure of the threat is shifting. Practical steps include:

• Assume dual extortion: Plan for both encryption and data theft in incident response playbooks.
• Focus on resilience, not ransom: Build robust backup, identity protection, and recovery capabilities.
• Don’t trust “promises”: Even if pressured, recognize that paying affiliates offers no real assurance of protection.
• Monitor affiliate migration trends: Threat intelligence on affiliate behavior can provide early warning of shifts in tactics and target sectors.

The affiliate economy is the engine that powers ransomware in 2025. Groups may fall, but affiliates endure, bringing their knowledge and stolen data into the next iteration of the ecosystem. For defenders, this means one thing: resilience, transparency, and preparation matter far more than negotiation.

Read more about ransomware and other cyberthreats in Ontinue’s 1H Threat Intelligence Report.