Ransomware as a Business
Faraday's read: ransomware scaled because someone applied basic economics to extortion. It is not a hacker's grudge; it is a business model with a funnel, a support desk, and a pricing team. Treat it as such and its behavior stops being mysterious. It automates because automation is cheap. It targets your backups because your backups are the only thing standing between the attacker and getting paid. It prices the ransom below your recovery cost because a rational victim pays when paying is cheaper than rebuilding. Understand the spreadsheet driving the adversary and you can predict the next move — it's just margin.
Knowledge check
From the attacker's economic perspective, why is destroying or encrypting backups the single most valuable action in a ransomware operation?
Show the answer
Backups are the victim's alternative to paying. If the victim can restore from a clean, reachable backup, the ransom is worth nothing and the attacker earns zero. By finding and destroying or encrypting the backups first, the attacker removes the victim's cheaper recovery option, which forces the true cost of not paying far above the ransom price and makes payment the rational choice. Neutralizing backups converts the entire operation from a nuisance into a collectable debt.