Inside the Playbook of Ransomware's Most Profitable Players

Cybersecurity In-Depth: Digging into data the latest attacks, threats, and trends using charts and tables.

Cybersecurity In-Depth: Digging into data the latest attacks, threats, and trends using charts and tables.

Successful ransomware groups have three key elements in common. Spoiler alert: indicators of success don't all revolve around artificial intelligence.

Ransomware gangs' continued success is well documented, from reports of substantial payouts and financial fallouts to prolonged disruptions. Each year, certain groups emerge in the top rankings, and what sets them apart is becoming clearer.

Success can be measured by a variety of factors including financial gains, brand reputation, victim downtime, activity, and for the ransomware-as-a-service (RaaS) model, the number of affiliates. Due to its effectiveness, highlighted by steady, alarming numbers recorded over the past five years, the threat continues to evolve to combat enterprise's defenses. However, research revealed what elements contribute to the top RaaS groups' success, which in turn can influence security strategies. The biggest hurdle is keeping pace with how quickly attackers' evolve.

Recent research from ReliaQuest measured ransomware success by the number of victims posted to a group's data leak site. Threat actors use data leak sites to publicly shame victims into paying a ransom, and the added pressures did pay off for groups. Based on those parameters, ReliaQuest discovered three facets of thriving ransomware groups. ReliaQuest crowned the Qilin ransomware as a "market leader" and warned that LockBit 5.0 is gaining traction by using the techniques listed below.

"Ransomware platforms built on automation, customization, and advanced tooling likely attract the most skilled affiliates and appear to create the most successful ransomware-as-a-service (RaaS) groups, judging from data-leak site victim counts," ReliaQuest wrote in the report .

Automation comprised the most important component. Researchers found that 80% of RaaS groups they analyzed included some automation and artificial intelligence (AI) in their platforms. Automation contributed to effectiveness by ramping up the speed of attacks. The average breakout time is now 18 minutes, leaving defenders with significantly less time to react, the report warned.

Additional researchers observed a similar trend. While groups increasingly use AI to further attack success, the tactic is still early-stage and unevenly adopted, explains Christiaan Beek, senior director of threat intelligence and analytics at Rapid7. Ransomware crews are experimenting with AI, mostly to speed up reconnaissance, craft more convincing phishing, or to automate parts of their operations. But what's evolving faster is the attackers' mindset, he adds.

"Attackers are starting to think in AI-driven workflows, blending automation and data-driven targeting," Beek tells Dark Reading. "It doesn't make them unstoppable, but it does make them faster, more adaptive, and harder to predict."

Multiple reports have emerged on threat actors increasing and lucrative use of AI for reconnaissance and social engineering. Ransomware groups also use AI to automate target selection and scale operations faster than before, warns Tom Hegel, threat research at SentinelOne. AI advances also lowered the barrier to entry, allowing less-skilled affiliates to conduct sophisticated campaigns - expanding the ransomware landscape even more.

"While we're not yet seeing fully autonomous ransomware operations (excluding prototypes), AI-driven automation is already shortening breakout times and boosting overall success," Hegel reveals. "It's another force multiplier in an ecosystem built around speed, scale, and leverage."

Customization was another driver of success, offered by 60% of RaaS groups ReliaQuest analyzed. It's importance lays in how it can "dynamically change how the ransomware operates during an attack." For example, it gives attackers' the ability to prioritize the strength or speed of encryption. Stronger encryption makes it more difficult for organizations to restore data without paying the ransom, while faster encryption can make it harder to contain the threat as the malware spreads to more files.

Advanced tooling came in at number three because only 50% of ransomware groups analyzed offered those capabilities on their platform. However, it poses a significant risk to enterprises despite any defenses that are deployed.

"Top-tier groups typically offer scripts that can bypass and disable EDR [endpoint detection and response] and antivirus tools on a compromised endpoint, as well as tools for deleting an organization's backups during ransomware deployment," the report stated.

Weaponized intelligence also fuels RaaS operators' success rates. The most profitable groups use intelligence to harvest victims' cloud data, map finance, and insurance postures, and assess sector sensitivities, tailoring their extortion demands, explains Beek.

In many instances, Rapid7 researchers observed them forgo the use of a ransomware binary entirely. Instead, they threatened to publicize the victims' stolen data and that was enough to elicit a payment.

"For example, we recently observed Crimson Collective has focused on stealing data from AWS environments for extortion, while Clop has run large data-theft extortion campaigns tied to enterprise application exploits rather than always relying on encrypting binaries," Beek says.

Overall, the RaaS operation model was designed for success. Operators build reliable tooling, leak sites, and payment infrastructure, while affiliates focus on intrusion and extortion, says Hegel, adding how the division of labor scales operations massively. The ecosystem consists of initial access brokers, multi-extortion tactics, strong operational security and decentralized infrastructure to survive takedowns.

"The result is a repeatable, scalable enterprise with the efficiency of a SaaS [software-as-a-service] company - just on the wrong side of the law," Hegel says.

Good news to come out of the ReliaQuest report is that "fewer than half of the RaaS groups analyzed can provide the complete trifecta of capabilities." While the report highlighted the most successful ransomware gangs, the researchers urged enterprises to focus security strategies on the ecosystem as a whole and the tactics, techniques and procedures shared among them versus any individual group.

Actions to take include implementing automated containment and response plays to keep pace with attackers' increasing speed, enforcing strict network segmentation to limit blast radius, and developing strategies that bolster visibility in the wake of advanced attacker tooling.

Features Writer, Dark Reading

Arielle spent the last decade working as a reporter, transitioning from human interest stories to covering all things cybersecurity related in 2020. Now, as a features writer for Dark Reading, she delves into the security problems enterprises face daily, hoping to provide context and actionable steps. She previously lived in Florida where she wrote for the Tampa Bay Times before returning to Boston where her cybersecurity career took off at SearchSecurity. When she's not writing cybersecurity, she pursues personal projects that include a mystery novel and poetry collection.

IDC MarketScape: Worldwide Exposure Management 2025 Vendor Assessment

The Forrester Wave™: Unified Vulnerability Management Solutions, Q3 2025

Miercom Test Results: PA-5450 Firewall Wins

Security Without Compromise Better security, higher performance and lower TCO

The Total Economic Impact™ Of Palo Alto Networks NextGeneration Firewalls

How AI & Autonomous Patching Eliminate Exposure Risks

The Cloud is No Longer Enough: Securing the Modern Digital Perimeter

Securing the Hybrid Workforce: Challenges and Solutions

Cybersecurity Outlook 2026

Threat Hunting Tools & Techniques for Staying Ahead of Cyber Adversaries