Ransomware Gangs Innovate With New Affiliate Models

This report describes Secureworks' analysis of two ransomware-as-a-service operators — DragonForce and Anubis — who have expanded affiliate models to include an "infrastructure-only" option and data-ransom/access-monetization services, enabling affiliates to brand or monetize access and increasing the scale and sophistication of extortion operations; the research emphasizes the business-like evolution of ransomware groups and recommends proactive defensive measures such as patching, phishing-resistant MFA, robust backups, and tested incident response plans.