How ransomware and data-extortion crews actually get in: the access-broker, affiliate and leak-site ecosystem (NCSC and NCA)

What it is. In September 2023 the UK National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) published a white paper, 'Ransomware, extortion and the cyber crime ecosystem'. Its argument is that the name on a ransom note tells you little about how you were breached. Several separate criminal services usually sit behind one attack, and defenders get more value from closing the doors those services use than from tracking individual ransomware brands. This page summarises the paper for security teams in our own words; it is not a substitute for reading it.

Encryption is optional now

The paper notes that some groups now steal data and extort the victim without deploying ransomware at all, and that crews pick whichever approach they expect to get paid for. In its account, disruptive encryption is favoured against organisations that cannot run without their systems, such as logistics and manufacturing, while leak-only extortion is favoured where privacy matters most, such as healthcare and law firms. Pairing data theft with short payment deadlines is described as a deliberate pressure tactic.

Most victims are not hand-picked

According to the NCSC and NCA, most initial access is opportunistic. Criminals gather large numbers of footholds and only later sort them for victims likely to pay, so a headline saying a company was 'targeted' rarely reflects how the intrusion began. The common ways in that the paper lists are: internet scanning for devices with known vulnerabilities (it names Exchange servers, Citrix and VMware platforms, VPNs and firewalls); brute-forcing and default or reused passwords against perimeter devices and services such as RDP and SSH; passwords from older breaches; and credentials harvested by infostealer malware spread through phishing, malicious adverts, search-result poisoning and cracked software.

The supply chain behind an attack

Initial access brokers buy or collect access in bulk, check that it works, work out roughly how large and valuable the victim is, and resell the best footholds, the paper says. In the ransomware-as-a-service (RaaS) model, which it calls the most common, a group rents out a portal for building ransomware, a negotiation channel and a data leak site, while the affiliate who bought or found the access carries out the intrusion; the RaaS group takes a share of the ransom. Because affiliates move between brands, a takedown or rebrand of one name does not remove the people who were using it.

Paying does not make the breach go away

The paper points out that leak sites exist to exploit victims' fear of regulators, yet an organisation can still be liable for failing to protect data whether or not the data is ever published. Its example is the reported LockBit negotiation with Royal Mail: because the attack was already public, paying to stop a release would not necessarily have prevented regulatory action. For Australian organisations the equivalent questions sit under the notifiable data breaches scheme and the ransomware payment reporting duty; see the related entries.

Practitioner checklist (the desk's own steps built on the paper's findings; only step 1 is the NCSC's stated recommendation)

1. Run a vulnerability management plan that puts internet-facing systems first; the NCSC says patching only what is known to be exploited today is not enough, because the exploits in use change quickly. 2. Remove default passwords and block password guessing on VPNs, firewalls, RDP and SSH; require MFA on every remote access path. 3. Assume credentials stolen from staff browsers and old breaches are for sale: watch for infostealer infections, reset exposed credentials and kill their sessions. 4. Block cracked software and treat search-ad and download lures as an access vector, not just a nuisance. 5. Plan for leak-only extortion, not just encryption: know where sensitive data lives, log large outbound transfers, and have your breach-notification decision path ready before a deadline arrives. 6. When a brand claims an attack, investigate how the affiliate got in rather than relying on that brand's known playbook.

Desk note: this page summarises the NCSC and NCA white paper 'Ransomware, extortion and the cyber crime ecosystem' (published 11 September 2023, read 28 October 2026). The paper also links the NCSC's ransomware guidance, its guidance on mitigating malware and ransomware attacks, and its guidance for organisations considering payment.