Ransomware Affiliate Terms: Shares, Entry Gates and Different Responsibilities

A high split does not mean an easy way in. Six programme ads in our selected 2026 sample state or imply a split, from 70% to 95%, and three say 90%. The same ads set entry conditions: an invitation fee, a deposit or files from a prepared target, and rules on whom not to attack.

The only 95% is a reward: Nova’s 22 April ad starts affiliates at 75% and lifts them to 95% once their revenue passes 1M (currency not stated).

The entry terms attach money to different objects: an invitation, a pre-compiled stub, or a refundable deposit offered as an alternative to prepared-target files. These cannot be collapsed into a price range for one product. The selected descriptions also assign different responsibilities for negotiation.

Brandefense Blackhole, our cybercrime database, logged 9,203 de-duplicated leak-site claims from 177 groups in the same period. The numbers are in the ransomware chapter of the report. This piece reads the other side of that data: the terms offered to the people who do the break-ins.

• 6Programme ads state or imply a shareSource: Edited catalogue and reconciled programme terms; promises, not payments
• 3Advertise a fixed 90% shareSource: Edited catalogue and reconciled programme terms; promises, not payments
• Conditional shareNova ties a higher rate to tenure or revenueSource: Edited catalogue and reconciled programme terms; promises, not payments
• Entry gatesInvitation, stub purchase or prepared-target/deposit alternativeSource: Edited catalogue and reconciled programme terms; promises, not payments

The Splits, Side by Side

The table lists every programme ad and partner post in our set that names money or terms, plus one kit resale offer that we keep apart. Dates are the day Blackhole first saw the post. Everything in it is what the seller says.

Vect, KRYBIT and Firestorm publish programme ads without a split; two partner notices concern pressure on victims. An unnamed-insider recipient claim is omitted from this comparison because its original meaning is unverified. The separate VanHelsing kit resale claims 80% and a $5,000 deposit; it is not a recruitment notice by the original crew.

The reconciled Nova terms describe 75% at entry, 85% after five months, 90% after a year and 95% above 1M in revenue. The threshold currency is unstated. This within-offer ladder rewards tenure and an earnings condition. It does not establish what any participant received.

The edited Nova description records a panel, BTC wallet and mixer, a build service of about ten minutes and a double-extortion blog. The build-service description does not establish delivered support, storage or an actual recruitment outcome.

The card matters because Nova ties the split to tenure and earnings, so the ad promises a higher share to affiliates who stay and meet its revenue condition. Nova was not a debut under the same label. Blackhole logged 8, 4, 2 and 8 Nova claims in January to April, then 23, 25 and 21 in May to July, and none after July.

The flat offers sit at 90%. On a $200,000 payment, 75% leaves an affiliate $150,000 and 95% leaves $190,000, while at 90% the crew keeps $20,000 (our arithmetic, not a figure from any ad). Gunra’s 11 April ad gives a fee instead of a split: the crew requires 15%, lower for some targets.

The lowest supported programme share in the selected descriptions is 70%: CRPX0 promised it in a 1 July demo-video post. The retained programme clause promises the partner 70% commission on every successful payment; it does not establish an actual payout.

Entry Charges Buy Different Things

The reconciled terms catalogue describes The Gentlemen’s entry condition as files from a prepared target or a 1,500 refundable deposit. The catalogue does not establish the exact refund trigger or whether a real applicant passed this gate. The positive observation is the alternative: existing target material can substitute for money.

KittyKatKrew’s 1 June description separates a $200 pre-compiled stub from an optional negotiation portal at $100 setup plus $30 monthly. The builder and source remain with the developers. The participant therefore receives a different level of control from someone offered source code.

FLOCKER’s 7 October description records a 90% share and a $170 invitation fee. An invitation is neither a builder nor a refund promise. The dollar denominations in these selected terms are unstated; no cross-ad price ranking is made.

Firestorm’s 24 July catalogue description asks for partners with corporate access and advertises a built-in CIS restriction. The retained description does not establish a per-key charge.

Together, these entry terms reveal a division of responsibility. A supplier can ask an affiliate to bring access or target material while retaining the builder, or charge for an invitation into its infrastructure. The headline share alone does not describe that contract.

Rules and Negotiation Belong to the Contract

The edited Nova and Gunra descriptions exclude CIS targets. Nova also names poor countries, North Korea and China. Firestorm advertises a built-in CIS check. These are programme rules as described in the catalogue, not a verified protection for any region.

Responsibilities differ as well. Gunra permits staff or affiliate negotiation; The Gentlemen assigns talks to the affiliate; KittyKatKrew prices a hosted portal; CRPX0’s programme description includes a dedicated team. These should be read as distinct advertised jobs. They are not four instances of one verified support service.

KRYBIT’s description refers to lawyers and journalists as pressure resources. The older Russian-speaking programme offers call and mailing services. Those claims show what a provider wants applicants to believe it can supply; the catalogue does not authenticate delivery.

Access Holders and Locker Providers Seek Each Other

The six access-related catalogue items include a reply under Vect’s recruitment thread. They are not six independent standalone threads. One 6 June item describes an access holder without malware skills seeking ready-to-deploy ransomware. Another, first seen on 3 February, offers to monetise access through a profit share.

These descriptions show complementary proposed inputs. One party says it has access and needs a locker; another says it has lockers and needs access. That supports an analysis of advertised labour, without verifying an intrusion, identifying a person or counting enrolled affiliates.

Interest, self-description and a distribution promise do not establish a completed partnership or a subsequent attack. Our forum-partnership investigation instead compares Vect’s key promise with The Gentlemen’s invitation to applicants.

Ads and Claims: Which Came First

We lined up each advertising crew’s ad month against its monthly leak-site claims in Blackhole. The table covers seven of the nine programme ads (FLOCKER and Firestorm are not in it), and ads are matched to leak-site groups by name; we have no other link. The result is mixed, and it does not support the idea that an ad starts a crew’s activity.

Six of the seven crews already had claims before the month of their ad. Vect posted 19 of its 25 claims in February, the month of its v2 ad. Gunra peaked at 15 claims in March and advertised in April, and KRYBIT claimed 23 in April before advertising in May. Only CRPX0 starts with the ad: 26 claims in July, 23 in August and none after.

KittyKatKrew logged 3 claims in February and none after its June switch to affiliates. Nova went quiet after July. The Gentlemen’s monthly claims rose from 90 in May to 159 in August after its ad, but they were already high at 48 to 91 a month.

The seven crews together hold 1,381 claims, and The Gentlemen supply 1,012 of them (our sums from the table). The direction is mixed and we claim no cause.

The Provider Still Controls Access to the Programme

The edited catalogue describes: Ex-partner calls Krybit amateurs and thieves: account stopped working, support silent

Advertised terms as catalogued: n/a.

The edited 26 September item attributes an account lockout and unanswered support to a self-described former KRYBIT partner. It is one uncorroborated account. Its value here is to identify a dependency in the advertised model: a promised share requires continued access to infrastructure the provider controls. It does not authenticate the complaint or show a demand, payment or negotiated discount.

Reading the Terms as a Defender

The terms describe a division of labour: the crew supplies the locker, the panel and the leak site, and the affiliate supplies the way in. A defender can use that. The CISA StopRansomware Guide covers the response steps, the wider #StopRansomware resources list advisories on named groups, and these readings come from the ads in this piece.

• Work on the way inThe ads tie revenue shares to payments. Some offers seek corporate access, so protecting remote access and credentials can reduce the opportunities available to affiliates.
• Watch the access market tooA crew buying access for a profit share shows access offered as a separate input. A listing naming your company is a reason to investigate possible exposure.
• Expect the target list to be chosenThe selected descriptions set target restrictions and seek corporate access. These ads show target-selection criteria, not a rule that size or sector determines every attack.
• Do not read the CIS clause as a shieldBars on Russia and the CIS say who the affiliate may not attack. They say nothing that protects anyone else.

Brandefense follows these crews through ransomware intelligence, which can help identify leak-site claims naming your organization. For the model behind the ads, read the glossary entry on ransomware-as-a-service; for the layers of pressure the ads sell, see our explainer on triple extortion. The tools that affiliates receive have their own price list in ransomware builder prices.

Evidence and Scope

This article uses the edited 60-item ransomware catalogue and the collected relay series for 1 January–27 October 2026. Catalogue dates are first-seen dates.

The selection is not a market census; programme descriptions, advertised terms and claims are different evidence units. The catalogue is an attributed account, not a fresh authentication of every original. October is partial and 22–28 July is sampled.

A claim is one canonical group–victim pair. The 9,203-claim series excludes 190 0APT claims and removes 171 spelling-variant duplicates. A repeated relay post is not independent confirmation. Asking terms do not establish payments, delivery or tested effectiveness.

AI-Assisted Preparation

Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.

Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.

Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.

Brandefense analysts reviewed and approved the findings.