The ransomware affiliate economy is consolidating. That is worse, not better.
Fewer brands, larger crews, sharper tradecraft. Our Q2 read on where the money is moving.
Brand fragmentation peaked last year. What we are watching now is a quieter consolidation: fewer logos, larger crews, and noticeably sharper operational discipline inside the surviving groups.
The implication for defenders is uncomfortable. The volume of incidents will not drop. The quality of the attackers behind each one will rise.