Experienced cybercriminals are moving away from large ransomware-as-a-service (RaaS) platforms due to increased law enforcement actions and internal scams like the AlphV/BlackCat gang’s exit scam. These criminals are now creating their own ransomware using leaked tools. Despite the change, experts warn that ransomware and extortion incidents are unlikely to decrease. The cybercrime economy still thrives by exploiting software flaws.
Law enforcement efforts are making a significant impact. For example, taking down the Qakbot botnet led to fewer attacks by the Black Basta ransomware group. However, criminals quickly adapt, switching to other malware and stolen passwords. The ongoing change in the cybercriminal world highlights the persistent threat of ransomware.