Safely Tracking Ransomware Affiliates

This report introduces SHADOW, an ethical, HUMINT-style workflow for observing ransomware affiliates while maintaining strict OPSEC and non-operational boundaries; it outlines synthetic persona construction, effective listening and tactical empathy, and an operational mindset optimized for long-term disruption rather than publicity. It maps the ransomware ecosystem—RaaS models, affiliate tiers, recruitment/vetting patterns, and program structures (closed, fee-based, referral)—and explains how to safely collect, package, and share intelligence with trusted channels. The paper also highlights early warning opportunities in forums/Telegram, considerations for emerging groups, and the importance of analyst resilience.