One anonymity service shared by 25 ransomware groups, watched for three years before seizure. The observation window has victims in it.
Where disclosure is not mandatory, the regional picture is assembled almost entirely from what attackers chose to publish.
A fivefold rise is affiliate recruitment, not innovation. Which makes affiliate confidence the scarce asset worth attacking.
The published “we don’t hit hospitals” rules were positioning. An operation whose affiliates pick the victims cannot implement a sector exclusion.