Ransomware payments flattened as access markets and infrastructure grew

At a glance

What this is: Chainalysis shows ransomware is increasingly shaped by access markets, shared infrastructure, and monetisation services rather than isolated extortion events.

Why it matters: For IAM, PAM, NHI, and security teams, this matters because the most effective disruption point is often upstream of encryption: access brokerage, standing privilege, and infrastructure enablement.

By the numbers:

• Total on-chain ransomware payments fell by approximately 8% to $820 million in 2025.
• The median ransom payment increased 368% year-over-year to nearly $60,000 in 2025.
• Claimed ransomware attacks rose 50% year-over-year in 2025.
• Initial Access Broker inflows typically preceded ransomware payments and victim leaks by roughly 30 days.

Context

Ransomware is no longer just a single intrusion followed by encryption and negotiation. The operating model now includes access brokers, hosting providers, proxy networks, loaders, and laundering channels that make the business of extortion scalable. For identity and security teams, that matters because compromise often begins long before the ransom note appears, and the earliest control failure is frequently credential, access, or exposure related.

This report frames ransomware as a marketplace problem as much as an incident-response problem. That is especially relevant to NHI governance, since service accounts, tokens, exposed credentials, and delegated access often create the entry conditions that access brokers monetise. Once that access is sold, the downstream event may look like ransomware, but the real weakness is the unmanaged trust and privilege that made the network tradable in the first place.

The article also shows that enforcement pressure is increasingly aimed at the enablement layer, not only at individual ransomware brands. That is an atypical but increasingly important shift for practitioners who have historically treated infrastructure, access brokerage, and identity governance as separate workstreams.

Key questions

Q: What breaks when organisations do not control access brokers and standing privilege before a ransomware event?

A: Ransomware becomes cheaper to scale because attackers can buy access instead of earning it. When standing privilege, exposed remote services, and unmanaged NHI credentials remain in place, the organisation has already supplied the inventory that brokers trade. That shifts the breach from a single intrusion problem to a repeatable monetisation problem.

Q: Why do access-market spikes matter before ransomware payments rise?

A: Because access brokerage is often the upstream signal that later extortion is being prepared. If broker inflows increase, the likely next steps are reuse, staging, and pressure against victims. That makes access-market movement a leading indicator for both payment attempts and leak-site escalation, not just an interesting dark web metric.

Q: What are the signs that ransomware infrastructure is being reused across different actors?

A: Look for shared hosting providers, common proxy networks, repeated malware loading infrastructure, and financial flows that cross actor boundaries. Reuse matters because it means one disruption can affect multiple campaigns, but it also means attribution based only on malware family can be misleading.

Q: How should security teams respond when ransomware is supported by shared infrastructure rather than one group?

A: They should widen response from one adversary to the service layer that sustains many adversaries. That means blocking abused hosting, tracking proxy and loader dependencies, and tightening identity and access controls so the organisation is harder to monetise even when infrastructure persists elsewhere.

Technical breakdown

How ransomware access brokerage changes the attack chain

Initial Access Brokers, or IABs, sell entry to victim environments so operators do not need to compromise every target directly. That decouples access acquisition from payload deployment and creates a repeatable supply chain for extortion. The broker may use stolen credentials, exploited remote services, or compromised hosts, then package the access for resale. In practical terms, ransomware defenders are no longer just fighting encryption. They are competing against a market that prices access, privilege, and operational convenience.

Practical implication: monitor for broker-style access patterns, not just post-encryption activity.

Why shared infrastructure makes ransomware harder to contain

Bulletproof hosting and residential proxy networks provide the concealment, reliability, and scale that ransomware crews need to stage, deliver, and manage operations. When criminal and state-linked actors use the same infrastructure layer, defenders face a convergence problem: the enabling services outlast any single campaign. That means one takedown or one group disruption does not eliminate the underlying service model. The real control point is the service ecosystem, including hosting, loaders, proxies, and laundering infrastructure.

Practical implication: build detection and disruption plans around infrastructure clusters, not isolated actor names.

What the on-chain timing signal says about monetisation

The report’s on-chain analysis suggests that spikes in Initial Access Broker inflows often precede both ransomware payments and victim leak-site activity by about 30 days. That makes access-market movement an early warning indicator for later extortion activity. In other words, monetisation pressure starts when access is traded, not when data is leaked. For defenders, that shifts the question from whether an incident has already happened to whether current access pathways are being actively commoditised.

Practical implication: treat unusual access-market signals as a precursor to extortion, not background noise.

Threat narrative

Attacker objective: The objective is to convert traded access and shared infrastructure into repeatable extortion revenue while reducing the cost and risk of direct intrusion.

1. Entry occurs when attackers or brokers obtain or trade access into victim networks, often through stolen credentials, exposed services, or compromised hosts.
2. Credential and access monetisation follows when that access is packaged, sold, or reused across ransomware operators and other criminal buyers.
3. Escalation happens when operators pair purchased access with shared hosting, loaders, and proxy infrastructure to stage extortion at scale.
4. Impact is realised through encryption, data theft, leak-site pressure, and business disruption that can outlast the initial intrusion.

Breaches seen in the wild

• Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ransomware is now an access economy, not just an extortion economy. The article shows that the real market is not only the ransom payment but the resale of access, the rental of infrastructure, and the movement of victim credentials through a broader criminal supply chain. That makes identity governance part of ransomware prevention, not merely an adjacent concern. Practitioners should treat access brokerage as an upstream business model that converts unmanaged trust into monetisable compromise.

Access-market telemetry is becoming a meaningful security signal. Chainalysis’ timing analysis suggests that broker inflows can precede payment and leak-site activity by weeks, which means the warning arrives before the payload does. That is valuable because it shifts detection toward the credential and access layer where intervention is still possible. The practitioner takeaway is to elevate access-trade indicators into threat hunting and incident prioritisation.

Shared hosting and proxy infrastructure collapse the boundary between cybercrime and state-linked activity. The article shows that the same concealment layer supports financially motivated ransomware and state-aligned operations, which complicates attribution and response. That convergence means defenders should care less about the label on the actor and more about the reusable infrastructure that keeps campaigns operational. The control problem is resilience against service-layer reuse, not just takedown of one name.

Infrastructure disruption is becoming a legitimate defensive strategy. The article’s examples of sanctions, seizures, and private-sector takedowns show that the enablement layer can be made more expensive and less reliable. That does not eliminate ransomware, but it can compress margins and slow operational reuse across actor sets. For practitioners, the practical conclusion is to support disruption efforts with local control hardening, because external pressure works best when internal access is already constrained.

Standing trust, especially in service access and third-party pathways, remains the economic weak point. When access can be bought and reused, the weakness is not only the attacker’s tooling but the organisation’s persistent trust assumptions. This is where NHI governance matters most: unmanaged machine accounts, tokens, and delegated access can become the inventory that brokers trade. Security teams should therefore view identity hygiene as a ransomware resilience control, not a back-office administrative task.

What this signals

Access brokerage is becoming the earliest practical control boundary for ransomware defence. When access can be purchased and reused, the most valuable intervention is no longer after encryption but before the victim environment becomes tradable. That shifts programme design toward identity telemetry, exposed service reduction, and tighter control of NHI credentials that can be monetised.

The convergence of ransomware and state-linked infrastructure use is a governance problem, not just an intelligence problem. The same hosting and proxy layers can support very different motives, which means attribution alone will not reduce exposure. Security leaders should plan for shared enablement services as a standing risk and build controls that reduce the value of the infrastructure before it is abused.

Ransomware resilience now depends on limiting the resale value of access. If remote entry, delegated privilege, and machine credentials are easy to broker, defenders inherit a market problem as well as a malware problem. The programme response is to make access hard to package, hard to reuse, and hard to operationalise across environments.

For practitioners

• Harden exposed access paths first Prioritise remote access services, VPNs, identity providers, and externally reachable admin interfaces that could be monetised by access brokers. Reduce exposure, enforce stronger authentication, and remove unnecessary external reachability before focusing on later-stage ransomware controls.
• Treat broker signals as pre-incident intelligence Feed access-market, leaked credential, and unusual authentication telemetry into threat hunting so suspected broker activity can be investigated before encryption or leak-site pressure begins. Escalate cases where access appears resold or reused across multiple systems.
• Shrink standing privilege across NHI estates Inventory service accounts, tokens, API keys, and delegated machine access, then remove privileges that are not required for current operations. Reassess whether persistent access paths could be resold, reused, or chained into broader compromise.
• Disrupt the enablement layer in incident response plans Extend ransomware playbooks to include infrastructure blocking, domain and hosting intelligence, proxy abuse indicators, and third-party service dependencies. Build response paths that assume the same infrastructure may support multiple campaigns or actor types.

Key takeaways

• Ransomware in 2025 behaved less like isolated extortion and more like a service economy built on access brokerage and shared infrastructure.
• The article’s timing analysis suggests that broker activity can foreshadow later payment and leak-site pressure, which makes access telemetry an early warning input.
• Reducing standing privilege, exposed services, and reusable NHI credentials is one of the most direct ways to lower ransomware monetisation potential.

Key terms

• Initial access broker: An initial access broker is an attacker or criminal intermediary that acquires footholds, such as stolen credentials, and then passes them to other threat actors. This role turns access into a commodity and increases the likelihood that simple credential exposure will become a broader breach.
• Bullet-Proof Hosting: Bullet-proof hosting is hosting designed to resist takedowns, complaints, and law enforcement pressure. Operators use it to keep malicious sites, command infrastructure, or payment services online for longer periods. In cybercrime ecosystems, this kind of resilience supports ransomware, malware delivery, and other abuse that depends on persistent access.
• Residential Proxy: A residential proxy routes traffic through an address assigned to a real consumer device or household connection. That makes the traffic look more legitimate than datacentre-based proxies, which is why abuse actors use it to bypass reputation checks and blend into normal user traffic.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps identity and security practitioners strengthen the controls that reduce credential abuse and access resale risk.