As the ransomware racket has evolved it has become both more commercial and more professional. New ransomware gangs have adopted the language and practices of startups, for example, DarkSide, which pledges to provide real-time support and guaranteed turnaround times to clients. It even professes a version of corporate social responsibility, claiming that they won’t attack hospitals or schools. REvil ransomware offers a range of support options to clients. The Maze ransomware tool operates an affiliate-style business model, taking a percentage of all the attacks made using their technology. Earlier this year, Reuters reported an attack from Ragnar Locker on a travel firm CWT, describing the support offered to the company by the attackers, and a discount if they paid promptly. They even kept the lines of communication open after the decryption keys had been handed over in case the company needed any help getting operations back up to speed. The kind of market research that merger and acquisition professionals employ is now a key part of the ransomware toolkit, with attackers expected to produce a detailed understanding of the ability and willingness of a target organization to pay up.