What the #StopRansomware advisories say about the ransomware economy: payments, sectors, affiliates
The #StopRansomware series of joint cybersecurity advisories, published by CISA, the FBI and partner agencies, is usually read as incident-response material: indicators of compromise, tactic mappings, mitigation checklists. Read a few of them side by side, they also form an unusual public record of how the ransomware economy is organized. The advisories on ALPHV/Blackcat, Black Basta and Medusa each describe, in deliberately dry language, who does the work, how access to networks is bought, and how victims are pushed toward paying.
A labor market, not a single gang
The Medusa advisory (AA25-071A, first published in March 2025 and updated in August 2026, also posted by the FBI) is the most explicit about money. It states that Medusa developers recruit initial access brokers on cybercriminal forums, offering payments between $100 and $1 million to IABs, as well as the opportunity to work exclusively for Medusa, and notes that most IABs work for multiple ransomware variants at the same time. Access to networks is the commodity; the brand that buys it is largely interchangeable. The same advisory describes a tiered affiliate model: Medusa started as a closed operation in June 2021 and moved to a ransomware-as-a-service structure in early 2023, granting affiliates varying levels of trust based upon experience and profitability. For newer affiliates, ransom negotiation may be centrally controlled by the developers. The ALPHV/Blackcat advisory and the Black Basta advisory describe their subjects the same way: RaaS operations in which named affiliates do the intrusion and extortion work under conditions set by the core group. The leak site as a payment mechanism
The advisories treat leak sites as part of the payment process rather than as publicity. Medusa's .onion site lists victims with countdown timers, and a victim can pay $10,000 in cryptocurrency to add a single day to the timer. Actors offer a time-limited lower rate for fast payment and, according to the advisory, base their demands on a victim's publicly posted revenue. It also records what can happen after payment: one paying victim was contacted again for an additional half of the ransom, allegedly for a 'true decryptor', and the authors note that there is no way to verify that stolen data is actually removed. The Black Basta advisory describes a parallel mechanic: ransom notes give victims 10 to 12 days before data is published on the group's 'Basta News' Tor site. ALPHV's update documents the opposite edge of the market, where some affiliates run extortion on stolen data alone, without deploying ransomware at all. Opportunistic targeting, recurring sectors
None of the three groups is described as selective. Medusa actors operate opportunistically by targeting victims with unpatched software, yet health care has been a frequent victim, and as of April 2026 the advisory counts more than 500 Medusa victims across critical infrastructure sectors. Black Basta affiliates had affected over 500 organizations globally as of May 2024, across at least 12 of 16 critical infrastructure sectors, with health care called out as attractive because of its dependence on technology and the disruption an attack causes to patient care. ALPHV's update noted that of nearly 70 leaked victims since mid-December 2023, health care was the most commonly victimized sector, a period that followed the group's administrator posting encouragement to target hospitals after operational action against its infrastructure. Falling payments, standing sanctions risk
On payment behavior, the government's published position is regulatory rather than statistical. OFAC's updated advisory on ransomware payments, issued in September 2021, states that the US government strongly discourages all private companies and citizens from paying ransom or extortion demands, warns that facilitators such as financial institutions, cyber insurers and incident response firms can face civil penalties on a strict liability basis, and notes a presumption of denial for licenses involving ransomware payments to sanctioned parties. The same document, announced alongside Treasury's designation of the exchange Suex for facilitating ransomware proceeds, tells victims that reporting an attack promptly to law enforcement or CISA can bring voluntary self-disclosure credit and significant mitigation, while cautioning that there is no guarantee of regaining access to data. Market data shows the pressure on the payment side. Chainalysis measured roughly $813.55 million in 2024 ransomware payments, about 35 percent below 2023's record $1.25 billion and the first decline since 2022, with fewer than half of recorded incidents ending in payment; a negotiator cited in the report estimates around 30 percent of negotiations lead to payment. Chainalysis also observed final payments clustering between $150,000 and $250,000 regardless of initial demands, meaning negotiation, not the opening number, tends to set the final price. Why the advisories name affiliates
The recurring detail across these documents is structural: the person who compromises the network, the person who negotiates, the developer who maintains the ransomware and the service that cashes out the proceeds are different parties, often in different jurisdictions. That is why the advisories name affiliates, initial access brokers and intermediaries rather than a single brand. Enforcement follows the roles, as when Treasury designated Suex, the first virtual currency exchange designated for facilitating ransomware proceeds, tied to at least eight ransomware variants, without attributing a sanctions nexus to any particular ransomware-as-a-service variant. For readers tracking leak sites, the practical takeaway matches what we covered in how ransomware leak sites operate on .onion: the countdown clock is a payment mechanism, and the surrounding machinery of broker pricing, tiered affiliates and sanctions exposure for facilitators is what these advisories are actually documenting.
