The operators behind DragonForce and Anubis ransomware-as-a-service (RaaS) schemes are innovating their business models to attract affiliates and expand their influence. Similar to legitimate businesses, these ransomware groups are developing new services to boost market share and profitability, leveraging ecosystem disruptions to offer hackers novel collaboration opportunities. DragonForce, originally launched as a traditional RaaS in August 2023, recently rebranded as a “cartel,” shifting to a distributed model that allows affiliates to create their own brands. This model offers hackers DragonForce’s infrastructure and tools without requiring them to use DragonForce’s encryptor, appealing to sophisticated actors who prefer deploying their own malware while benefiting from established systems. However, shared infrastructure poses risks, as one affiliate’s compromise could expose details of others. Anubis, tracked since December 2024, provides three (3) monetization schemes: traditional encryption attacks (80% of ransom to affiliates), data extortion (60%), and access monetization (50%). Anubis uses various tactics to pressure victims, such as threatening data publication and notifying victims’ customers. This approach extends further by threatening to report incidents to regulators, a tactic not commonly seen but similar to methods used by AlphV/BlackCat. Researchers have noted that post-LockBit takedown, there has been increased experimentation with operating models among ransomware groups. The success of new models could reshape the ransomware landscape, akin to LockBit’s affiliate-driven rise before its disruption by law enforcement.