Ransomware has long dominated news headlines, but the narrative is increasingly distorted by hype, particularly the claim that AI is revolutionizing ransomware operations. While AI has a role in day-to-day ransomware attacks, the ever-increasing volume is far more driven by the well-established business model: Ransomware-as-a-Service (RaaS). The true actors behind most incidents are not the developers of the encryptors, but the affiliates who deploy them. Understanding who these affiliates are, how they operate, and where they overlap is far more valuable than chasing the latest AI scare story.

This talk cuts through the noise. We debunk the AI-overhype, explain why a deep understanding of RaaS economics and affiliate behavior is essential to effective defense, and make the case that high-quality threat intelligence is the most sustainable way to track these actors. Drawing on ESET's ongoing ransomware research, we present concrete case studies showing how affiliates can be identified, correlated, and monitored through telemetry, open-source intelligence, and careful analysis of their operational patterns; without ever needing to compromise operators’ infrastructure. The result is a practical, evidence-based view of where ransomware is today, and how defenders can keep pace without buying into the hype.

Jakub Souček

Senior Malware Researcher, ESET