Group-based threat intelligence assumes a manageable set of adversaries. The number of groups is approaching the number of incidents.
Five names, five sectors, one explanation. A list of five describes the head of a very long distribution.
Knowing this operation is active tells a defender nothing, because it is active everywhere. Naming it is naming the weather.
An ecosystem-wide long tail alongside sector concentration. Both are true, and it complicates the corpus’s own argument.
A fivefold rise is affiliate recruitment, not innovation. Which makes affiliate confidence the scarce asset worth attacking.
Removing the largest operator did not reduce the market. It redistributed it into smaller, less trackable operations.
Somebody looked at the population of people who wanted to run ransomware, decided it was larger than the population who could, and built a product for the difference.
In a lawful market, removing the dominant supplier reduces volume because capacity is expensive to replace. Here the capacity is software.