The cybercrime supply chain has five stages, each with a price

Chris Nyhuis (Vigilant) explains that modern ransomware activity functions as a multi‑stage cybercrime supply chain made up of five businesses—harvesters (infostealer operators), brokers, ransomware‑as‑a‑service operators, affiliates, and launderers—and covers market pricing (stolen credential logs for $5–$50, broker listings under $1,000) and tactics such as using stolen session cookies to bypass multi‑factor authentication.