What the ransom note won’t say

This article details the ongoing issues surrounding the BlackCat ransomware gang’s affiliate, who attempted to defraud the group after carrying out a significant attack on Change Healthcare. The incident highlights the increasingly complex and franchise-like nature of ransomware operations, where affiliates operate with limited direct involvement in attacks but receive a cut of the ransom. This model, driven by incentives and competition, contributes to the rising volume of ransomware attacks and shifts in targeting, particularly towards smaller organizations with less robust defenses.