A ransomware operation leases its encryption tool to affiliates, splits each payment with them, and runs a leak site threatening to publish stolen files if victims do not pay. Which actor type and motivation does this describe?

Organized crime groups operate cybercrime as a business. Ransomware-as-a-service models, in which developers lease malware to affiliates and share proceeds, show structure, division of labor and a profit motive. Leak sites add double extortion: victims are pressured to pay both to decrypt data and to prevent publication. These traits match a crime syndicate motivated by financial gain and extortion. A hacktivist group might leak data to expose wrongdoing, but it publishes to advance a cause, not to collect payment in exchange for silence. A state-sponsored group pursuing intelligence collection wants stealth and long-term access; a public leak site and ransom demands would expose its operation and conflict with that goal. An unskilled attacker seeking notoriety lacks the infrastructure, affiliate management and payment operations described, and its interest is recognition rather than revenue. Exam caveat: some state-linked groups run financially motivated operations, but when the scenario centers on payment, affiliates and extortion, the expected answer is organized crime. Operational check: confirm the group's tooling against threat intelligence, isolate affected systems, notify legal and leadership about extortion and disclosure obligations, and verify that offline backups are intact before any decision about payment.