The Business of Extortion: How Ransomware Makes Money

This article provides a concise "back-to-basics" overview of modern ransomware activity, describing the three primary extortion modalities — encryption-based ransom, exfiltration and public disclosure (double-extortion), and DDoS/network extortion — discusses market and actor behavior (e.g., REvil, Babuk), and offers high-level mitigation considerations and observations about evolving tactics and the ransomware ecosystem.