What is the difference between a ransomware family, a group and an affiliate?

The family is the malware: the encryption program and its tools, usually named after the code or the ransom note, such as LockBit or Akira. The group is the criminal organisation that develops and runs it, including the leak site, the payment process and the negotiators. An affiliate is a separate criminal team that rents the malware from the group and carries out the actual break-ins, in return for a share of the ransom, often the larger share. This matters for defenders because the same family can arrive through very different routes, depending on which affiliate is using it, while one affiliate may switch between families from month to month. Government advisories therefore describe both: the family's indicators and the techniques its affiliates have been seen using. When a report says a group attacked a company, it usually means that one of its affiliates did.

← All 25 questions on Ransomware groups and familiesAll topics