Ransomware franchising: How do groups get started?

**Executive summary:** This report surveys the ransomware ecosystem, describing how ransomware teams are organized, the different operational models (fire-and-forget cryptolockers, enterprise-focused big-game hunting, and rebranded groups), and the role of Ransomware-as-a-Service (RaaS) — including low-cost offerings such as Ranion — in lowering barriers for new threat actors; it highlights active high-profile groups (e.g., REvil, Conti, LockBit, Cuba, ALPHV) and urges proactive defensive measures given ransomware's growing organization and impact on businesses.