Like whitebox servers, rent-a-crew crime 'affiliates' have commoditized ransomware

An interview with a ransomware negotiator outlines a surge and realignment among ransomware groups—Akira, Qilin, RansomHub, Black Basta and the emerging Cactus—driven by affiliates migrating after law-enforcement disruptions; researchers observed shared tooling (BlackConnect) and links to Qakbot, increasing persistent access and data-exfiltration risk. While takedowns have disrupted core operators, affiliates persist and can rapidly create highly active new gangs, forcing defenders to weigh payment primarily to prevent data leaks rather than to restore operations.