The Commercialisation of Cybercrime

Ransomware-as-a-Service (RaaS)

Ransomware continues to operate as a structured, commercialised ecosystem. RaaS enables fewer technical actors to execute attacks by purchasing access, tools, and infrastructure, while developers maintain profit-sharing arrangements. CrowdStrike and Check Point both report that RaaS activity has reached record levels in 2025, with at least 85 active extortion groups globally.

Multi-Phase Extortion

Double-extortion attacks (an attack involving data theft and system encryption) are now the baseline. Emerging tactics, sometimes referred to as “quadruple extortion,” combine data theft, encryption, leaks, and additional coercive actions. These strategies place significant operational and financial pressure on victims.

Access Brokers and Anonymity

Access brokers act as intermediaries, selling compromised credentials or network access to the highest bidder. This professionalisation of cyber crime complicates attribution, enforcement, and recovery. Coupled with increasingly anonymous cryptocurrency transactions, tracking and prosecuting offenders has become even more difficult.

Ethical and Strategic Implications for Victims

Regulatory and moral questions arise when considering ransom payments. Organisations face difficult choices as paying may restore operations, but it could also be funding illicit activity, while non-payment may increase operational exposure. Board-level discussions must include both technical and ethical considerations so organisations can pick the best course of action.