Modern ransomware attacks have formed a Ransomware-as-a-Service (RaaS) ecosystem, in which the core development team is responsible for writing code and maintaining infrastructure, while affiliates handle the actual intrusion and deployment, with both parties sharing the ransom proceeds on a proportional basis.