How Do Ransomware Gangs Work? How Ransomware Groups Operate

By Ehtijad Ali
Updated: October 2026
Reading time: about 12 minutes

How do ransomware gangs work - chart showing developers, affiliates, initial access brokers, negotiators and money handlers attacking a victim company — How do ransomware gangs work? Each desk is a different job inside the same criminal team.

Most people picture one hacker, alone, in a dark room.

That picture is wrong.

A ransomware gang is a team. One person builds the software. One person breaks in. One person asks for the money. One person hides it. They have never met.

This is how do ransomware gangs work, told in plain words. Who does what, how the money is split, and what actually keeps you safe.

Every case here comes from public court records and official statements by the U.S. Department of Justice and Europol. No guessing.

What is in this guide?

How do ransomware gangs work, in one minute

If you only have a minute, here it is.

How do ransomware gangs work? Like a small company with six departments.

Developers build the software that locks files.
Brokers find a way into a company and sell it.
Affiliates rent the software and run the attack.
Negotiators chat with the victim and set the price.
Money handlers move the crypto so nobody can follow it.
A help desk answers the victim’s questions, so paying is easy.
Files are copied first, then locked. That is two threats, not one.
Everybody takes a cut. That is why the model spreads.

That is the whole answer. Now the interesting part: how each step really happens.

What is ransomware?

Ransomware is bad software. It locks your files so you cannot open them.

Think of a thief who puts a padlock on your front door. Your things are still inside. You just cannot reach them.

Then the attacker asks for money. They promise to send the key. They almost always want crypto, like Bitcoin.

The word “ransom” means money paid to get something back. That is where the name comes from.

New to these words? Our dark web glossary explains them in simple language.

Now the main question. How do ransomware gangs work?

How do ransomware gangs work?

So, how do ransomware gangs work day to day? They cut the crime into small pieces.

One group makes the tools. Another group rents them. The renters are called affiliates.

Police call this Ransomware-as-a-Service, or RaaS.

Picture a bad copy of a burger chain. The head office gives you the recipe, the sign and the training. You run one shop. You send part of your money back.

That is exactly how do ransomware gangs work. The head office builds the software. The affiliate does the attack. Both share the cash.

The DOJ described this same setup in the LockBit case.

The 6 jobs inside a ransomware gang

Court papers show the same six roles again and again. Here they are.

So, how do ransomware gangs work inside the team? Every job is small, and every job is paid.

1. The developers

Developers write the code that locks the files. They fix bugs. They add new features.

Many of them never attack anyone. They build the tool and rent it out.

Some even build a control panel. Affiliates log in to it. It looks like normal office software.

2. The initial access brokers

A broker finds a way into a company network. Then they sell that way in.

It might be a stolen password. It might be a weak remote login. It might be a bug in old software.

They lock nothing. They open the door, take the payment and walk away.

3. The affiliates

Affiliates press the button. They use the software they rented.

They move around the network. They hunt for the backups. They copy files before locking them.

Then they start the lock and leave a note on the screen.

4. The negotiators

A negotiator chats with the victim on a private page.

They sound calm and polite. That is on purpose. Calm words make people pay faster.

They set the price. They set the deadline. They often offer a discount to close the deal.

5. The money handlers

Crypto payments sit on a public record. So the gang needs help hiding the trail.

Money handlers push the coins through many wallets. They use mixing services and shady exchanges.

Their job is simple. Make the money hard to follow.

Some are paid in crypto, some in cash. Most never touch the ransomware itself.

6. The help desk

This part shocks most people. Big gangs run a support desk.

Why? A victim who cannot pay is worth nothing to them.

So they explain how to buy crypto. They test the unlock key. They answer questions. It is customer service for a crime.

How ransomware gangs make money

How do ransomware gangs work with money - crypto ransom payment flowing between the victim, affiliates, developers, negotiators and money handlers — One ransom payment, shared between every role in the group.

How do ransomware gangs work with the money? They split it, the way a company splits profit.

It starts as one payment from the victim. Then it breaks apart.

The affiliate keeps the biggest share, because they did the attack.
The developers keep a smaller share, like a rental fee.
The broker was already paid, back when they sold the access.
The money handler takes a cut for cleaning the coins.

That is the real reason this model spreads so fast. Everyone gets paid for one small job.

Crypto is a big part of the story. For the background, read our guide to the Silk Road dark web story. It shows how hidden sites and Bitcoin first came together.

What a ransom chat looks like

How do ransomware gangs work during a ransom chat - a locked screen ransom note next to a negotiation chat window and an incident response checklist — A locked screen, a chat window and a deadline. That is the pressure, by design.

How do ransomware gangs work once the victim replies? They talk, and they push.

The note on the screen gives a link. The link opens a chat page on a hidden site.

Inside, the talk is short and business-like. It usually goes like this:

The gang gives a price and a deadline.
The victim asks for proof that the key works.
The gang unlocks one or two small files for free.
The victim asks for a lower price.
The gang drops it a little, then adds pressure.

Pressure is the real tool. A shorter deadline. A threat to publish. A price that climbs.

Police teams such as StopRansomware tell victims to report the attack and get help before paying anything.

Why leak sites matter

How do ransomware gangs work when a victim says no? They use a leak site.

Locking files is only half the trick now. Most gangs copy the files first.

Then they run a public page on the dark web. On it they name the victims who did not pay.

This is called double extortion. Two threats at the same time:

You cannot use your own files.
Your private files may be shown to the world.

Good backups fix the first threat. They do nothing about the second one.

Not sure what the dark web really is? Our plain guide to deep web vs dark web clears it up in a few minutes.

A ransomware attack, step by step

How do ransomware gangs work from the first minute to the last? In this order.

They get in. A stolen password, a fake email or an old server opens the door.
They look around. They stay quiet for days or weeks and learn the network.
They find the backups. Backups go first, because backups save the victim.
They copy the files. Private data leaves the building before anything is locked.
They lock everything. Usually at night, or on a holiday.
They leave a note. It has a price and a chat link.
They start the clock. The threats grow as the deadline gets closer.

Notice the quiet middle. The loud, scary moment is the last step, not the first.

The most common ways they get in

How do ransomware gangs work their way inside? Usually through a very simple gap.

Fake emails. One person clicks a link and types a password on a fake page.
Stolen passwords. Old leaked passwords are bought cheaply and tested on company logins.
Remote desktop. A remote login is left open to the internet with a weak password.
Old software. A known bug was never patched, so the fix never arrived.
Trusted suppliers. A smaller partner is hacked first, then used as a bridge.

Every one of these is cheap for the attacker. That is why they stay popular.

None of them needs a genius. They need one person to be busy, tired or rushed.

Who do ransomware gangs target?

How do ransomware gangs work out who to attack? They look for the easiest win.

They want two things. Weak security, and a strong reason to pay fast.

Hospitals and clinics. Patient care cannot wait a week.
Schools and colleges. Small IT teams, lots of old computers.
Small factories. Every stopped hour costs real money.
Local councils. Public services have to keep running.
Law and accounting firms. They hold very private client files.

Some affiliates also hunt in bulk. They scan the internet for open logins and old servers, then check who looks able to pay.

Your own habits matter too. The less data you leak, the fewer clues an attacker has. See what information your browser shares.

Why these gangs are hard to stop

By now you can see how do ransomware gangs work as a team. That teamwork is also their shield.

The members are spread across many countries.
They almost never meet in real life.
Most of them only use fake names.
If one group closes, the members join another.
Old code gets copied and given a new name.

Europol has reported that these groups often split up, rename themselves and come back.

Police work still helps a lot. Teams have seized gang websites, arrested affiliates and released free unlock tools.

Real cases from court records

These are not stories. They are public cases, and together they show how do ransomware gangs work as a group.

The developer: LockBit

The DOJ charged a Russian national with building and running LockBit, the software many affiliates rented.

That is role number one: the person who makes the tool, not the person who uses it.

The affiliates: ALPHV / BlackCat

The DOJ sentenced two Americans who attacked victims using ALPHV/BlackCat.

They did not write the software. They rented it. That is role number three.

The door opener: selling access

A Russian citizen was sent to federal prison for hacking U.S. companies and enabling major ransomware attacks.

He broke in and handed the keys to somebody else. That is role number two.

Three cases, three different jobs, one business model. For the longer history, see our dark web timeline.

Four myths about ransomware gangs

How do ransomware gangs work in real life, not in films? Let us clear up four myths.

Myth 1: it is one genius hacker

It is a group with split jobs. Most members only know their own small part.

Myth 2: only huge companies get hit

Small shops, schools and clinics are hit every week. They are easier, and they still pay.

Myth 3: paying makes it end

Paying buys a promise, not a guarantee. Some victims are attacked again by the same people.

Myth 4: backups solve everything

Backups bring your files back. They cannot un-leak the copy the gang already took.

What to do in the first hour of an attack

How do ransomware gangs work in the first hour? They count on panic. So stay calm.

Do not pay right away. Nothing good happens in a rush.
Unplug the network. Take infected machines off Wi-Fi and cables.
Do not switch the computers off. Useful evidence sits in memory.
Photograph the ransom note. Investigators will need it.
Call the police and your insurer. In the U.S. you can report to the FBI IC3.
Check your offline backups. You may not need the attacker at all.

Free unlock tools also exist for some older ransomware families. Police projects release them after a gang is taken down.

How to protect yourself and your business

Once you know how do ransomware gangs work, the safety steps stop feeling boring. Each one closes a door they use.

Update your software. Old software has known holes.
Use strong, different passwords. One password per account.
Turn on two-step login. A stolen password alone is then useless.
Keep offline backups. Test them once a month.
Limit admin accounts. Fewer admins means less damage.
Train your staff. Most break-ins start with one click on a fake email.

The CISA ransomware guide lists the same basics in more detail.

Worried your details are already out there? Follow our steps to check if your email was in a data breach.

Questions people ask

How do ransomware gangs work in simple words?

Like a company. One team builds the software, one team breaks in, one team asks for money. They all share the payment.

Is a ransomware gang just one person?

Almost never. A big attack needs several people with different skills.

How do ransomware gangs work with affiliates?

The main group rents out its software. The affiliate runs the attack and sends back a share of the money.

Do they really have customer support?

Yes. A help desk makes it easier for a victim to pay. That is the only reason it exists.

Should a victim pay the ransom?

Police forces advise against it. Paying does not promise your files back, and it funds the next attack. Report it instead.

Why do they ask for crypto?

Crypto moves fast and crosses borders. It is not fully secret, but it is harder to freeze than a bank transfer.

How do ransomware gangs work after a police takedown?

They often rebuild. The same people pick a new name, copy the old code and start again.

How long does a ransomware attack take?

The quiet part can last weeks. The locking part often takes only a few hours, usually at night.

Can a home user be hit too?

Yes. Home users are hit less often, but it happens. Backups and updates protect you well.

How do ransomware gangs operate day to day?

Much like a small company. Developers build and update the ransomware, affiliates break into victims and run the attacks, negotiators talk to victims, money handlers move the crypto, and a help desk answers victims’ questions. Most gangs work as “ransomware as a service”: the developers rent their tools to affiliates and take a cut of every ransom paid.

Is a ransomware gang the same as a cybercrime group?

A ransomware gang is one type of cybercrime group. “Cybercrime group” is the wider term and also covers groups that run scams, steal card details or sell access to hacked networks. A ransomware gang focuses on locking or stealing data and demanding money. People also call them ransomware groups; the two words mean the same thing.

What are some well-known ransomware groups?

Well-known names include LockBit, ALPHV (also called BlackCat), Conti and Cl0p. Several of these have been disrupted by police or have shut down, but their members often rebrand and come back under new names, which is why the list keeps changing.

Helpful links and sources

Every claim above comes from the records below. You can see how we check our work on our sources and research page.

Read them together and you get the same answer to how do ransomware gangs work.

Official records

Research and background

The short version

So, how do ransomware gangs work? Like a business, not like a movie.

Six jobs. One shared payment. Two threats instead of one.

And the way in is almost always small: an old password, an unpatched server, one clicked link.

That is the good news. Simple habits close simple doors.

Now you know how do ransomware gangs work, and where they are weakest.