RESEARCH · 8 min read
Ransomware Affiliate Tradecraft in 2026
Leaked affiliate manuals and chat logs from the last 18 months give us an unusually clear view of how ransomware crews actually operate. The patterns are remarkably consistent.
Initial access is bought, not earned
IABs sell footholds — VPN creds, exposed RDP, web-shell on a forgotten box. Most affiliates never touch a phishing kit.
Dwell time is shrinking
Median time-to-encrypt dropped under 24 hours for top crews. They live off the land, abuse RMM tools and avoid custom malware entirely.
- AnyDesk / Atera / ScreenConnect abuse
- Rclone for staging exfil
- Veeam and backup deletion before encryption
Double extortion is the norm
Exfil first, encrypt second. The leak site is the leverage, not the encryption.
Tools mentioned
VelociraptorGRRVolatilityRcloneAnyDeskATT&CK
⟩ takeaway
Defend the access brokers' entry points and detect RMM abuse. You'll catch most affiliates before the encryptor runs.
⟩ keep reading
Related articles
Mobile Malware in 2026: How It Gets In and How to Stay Safer
Spyware, banking trojans and sideloaded RATs — how modern mobile malware lands on a device, the tools that detect it, and the habits that keep you off the target list.
Phishing Defense That Actually Works
AiTM kits, QR 'quishing' and callback scams beat old training. What actually lowers real risk: phishing-resistant auth, a detonation layer on the inbox, and drills that mirror current tradecraft.
Splunk Detection Tips: From Noisy Alerts to Real-Time Signal
SPL patterns, accelerated data models and tstats tricks that turn a slow, noisy Splunk into a near-real-time detection engine — with snippets you can paste in today.