What the Ransom Note Won’t Say

Why It Matters

Understanding ransomware as an organized market reveals hidden supply‑chain risks and why traditional perimeter defenses often fail, prompting enterprises to rethink threat‑intel and resilience strategies.

Key Takeaways

• Ransomware now runs as a franchise with specialized affiliates and brokers
• ESET data shows a 13 % ransomware rise in H2 2025 after 30 % H1 growth
• Median ransom dropped to $115 k, shifting focus to volume attacks
• EDR‑killer market expands; 90 tools use BYOVD to bypass defenses

Pulse Analysis

The ransomware landscape has evolved from isolated break‑ins to a multi‑tiered service economy. Developers sell ransomware kits, while affiliates purchase access credentials from initial‑access brokers, and subscription services provide encryption tools, double‑extortion scripts, and even anti‑EDR payloads. This division of labor mirrors a gig‑economy model, allowing low‑skill actors to launch attacks at scale and driving the 13 % surge in incidents reported by ESET for the second half of 2025. For executives, the implication is clear: risk now originates not only from direct network breaches but also from third‑party supply chains that may harbor compromised credentials.

Competition fuels relentless innovation among cybercriminals. When groups like LockBit or BlackCat are disrupted, their affiliates quickly migrate to emerging platforms such as RansomHub, and new players like DragonForce seize market share by targeting rivals’ leak sites. This churn keeps entry barriers low, as ransomware‑as‑a‑service kits and disposable labor are readily available. Consequently, attackers shift toward smaller, less mature targets, where lower ransom payouts—median $115 k—are offset by higher volume, a trend highlighted by Verizon’s 2025 DBIR. Organizations must therefore monitor threat‑actor ecosystems, not just individual incidents, to anticipate emerging tactics.

Defenders are caught in a Red‑Queen race, where advances in detection are met with equally rapid countermeasures. EDR and XDR products have become primary targets; researchers have identified nearly 90 distinct EDR‑killer tools, many leveraging the Bring‑Your‑Own‑Vulnerable‑Driver technique to gain kernel privileges. The market for these anti‑tools is subscription‑based and increasingly AI‑enhanced, lowering the skill threshold for creating effective evasion modules. As AI lowers the cost of malware production, the volume of disposable code—"vibeware"—will rise, overwhelming traditional signature‑based defenses. Enterprises must adopt adaptive, intelligence‑driven security stacks and continuously map the ransomware supply chain to stay ahead of this accelerating threat.