Ransomware Builder Prices in 2026: Changing Packages in 59 Days

Six dated BLACKNET-00 listings across 59 days describe changing packages and access terms. The launch listing asks $500.

The 19 and 20 June source-code listings explicitly name USD 1,200 and USD 1,000. A one-buyer bundle asks $400, an open offer $20 and an August source-code listing $1,000 with the dollar denomination unstated. This is a package chronology, not a price index.

A separate April ad asked $50 for a builder, and a white-label platform was advertised at $5,000. The other selected dollar-denominated offers do not name the currency. These describe different packages, not verified sales.

The edited catalogue contains 14 tool-for-sale items and six free-builder items. Those are catalogue classifications, not counts of independent sellers, verified transactions or every offer in the collection. Fees for joining a programme are separate objects from prices for builders and platforms.

This piece is part of the Brandefense Cybercrime Report 2026. The wider picture, 9,203 de-duplicated leak-site claims from 177 groups, is in the ransomware chapter. Here we follow one thing: what the tools cost, who sells them and what cheap kits mean for smaller targets.

• $50Advertised price of a ransomware builder in a single short Telegram post on 29 AprilSource: Brandefense Blackhole, 1 January to 27 October 2026, found in a keyword-led hunt; amounts as advertised; two source-code ads name USD; other dollar denominations unspecified
• 6 dated listingsOne builder brand with different packages/access terms across 59 days; not six comparable productsSource: Brandefense Blackhole, 1 January to 27 October 2026, found in a keyword-led hunt; amounts as advertised; two source-code ads name USD; other dollar denominations unspecified
• $5,000Advertised one-time price of a white-label ransomware-as-a-service platformSource: Brandefense Blackhole, 1 January to 27 October 2026, found in a keyword-led hunt; amounts as advertised; two source-code ads name USD; other dollar denominations unspecified
• 6 catalogue itemsClassified as free-builder sharing, dated 5 January to 16 September; access and delivery not verifiedSource: Brandefense Blackhole, 1 January to 27 October 2026, found in a keyword-led hunt; amounts as advertised; two source-code ads name USD; other dollar denominations unspecified

What Did a Ransomware Builder Cost in 2026?

A ransomware builder is a program that turns a few choices into a working encryptor. The buyer picks the file extension, the ransom note and the payout address, and the builder produces the locker.

The table groups selected asking amounts with their dated packages. The two June source-code ads explicitly name USD; the other dollar amounts remain unspecified. Its order is not a currency conversion or a comparable-product price ranking.

Catalogue items classified as free-builder sharing come first and the offer priced in Telegram Stars comes last. Eight more sale items carried no price we could capture.

How to read this table. Every price is what a seller asked, and we saw no payment. Six dated listings are grouped by builder brand and channel context; a separate industrial-builder offer is grouped under the same channel, with common seller identity an inference. These are selected package descriptions, not a market rate.

The tools are only one cost line. The programme ads we cover in the ransomware chapter add fees, deposits and revenue splits, and our piece on negotiation for sale prices the talks that come after the encryptor. The EDR killer row has its own piece: EDR killer prices in 2026.

One Builder, Six Dated Listings Across 59 Days

BLACKNET-00’s selected sequence is associated with one builder brand and channel context. We group it for the package comparison; common seller identity is an inference. The dated audit preserves the named source-code amounts, while the edited catalogue records builder-and-injector and source-code packages.

The dated price audit records a $500 launch asking amount on 3 June. It does not authenticate every feature or the intended skill of buyers.

The sequence begins with a platform listing and later differentiates source-code and limited-buyer packages. Those rights are the analytical object here, rather than a claim about who bought the tool.

On 19 June a retained source-code price clause names an advertised final price of USD 1,200. On 20 June, a separate retained source-code price clause names USD 1,000. A separate 20 June listing offers the builder and injector as a $400 package for one buyer. Channel-level grouping does not authenticate a common seller.

The one-buyer condition sells restricted access. It is a different entitlement from the source-code terms, even when the offers appear in the same period.

A 21 June open offer asked $20, with the dollar denomination unstated.

The dated asking clauses do not establish a completed purchase or what a buyer received.

A 1 August listing asked $1,000 for the complete source code and advertised one-buyer rights.

The August source-code term is a different entitlement from a build or injector bundle. The advertisement does not establish why the terms changed.

The chronology changes the advertised package and rights. It does not establish completed payments, a buyer identity, a successful deployment or a reason for the changes.

Other Offers Describe Different Goods

The edited catalogue describes: Builder GUI, decryptor, web panel, countdown and BTC/XMR payout in a one-line chat ad

Advertised terms as catalogued: $50.

The $50 catalogue item advertises a builder GUI, decryptor, web panel and countdown. That package description does not establish a working encryptor. Algorithm-quality judgments are omitted: naming algorithms would not validate their implementation.

The edited catalogue describes: Builder pitched at industrial-control systems with the same posts claiming access to a US energy site; warns of attacks on US hospitals

Advertised terms as catalogued: $890.

The “industrial” label describes the pitch, not a tested capability against industrial systems. Its shared channel with later BLACKNET-00 offers permits a channel-level grouping, with common seller identity still an inference.

Six catalogue items are classified as free-builder sharing. They include cracked, leaked and re-shared builders. Those labels describe a distribution route, not a guarantee of free access, a safe download or a comparable paid product tier.

A Builder Purchase and a Programme Seat Buy Different Things

A standalone builder is a tool offer. A programme seat may bundle a locker, portal and support while leaving the affiliate responsible for access. FLOCKER advertised a $170 invitation fee; KittyKatKrew priced a stub separately from an optional hosted portal. Those terms are different objects from the source-code and one-buyer bundles above.

The affiliate-terms investigation compares fees, deposits and proof-of-access requirements, including The Gentlemen’s entry rule. The negotiation investigation follows who supplies the portal and who conducts the talks.

$5,000 for the Platform, $550 for the Defender Killer

The edited CRPX0 catalogue item records a $5,000 one-time white-label platform offer, including affiliate management, a branded leak site and a negotiation portal. The retained price clause says the buyer keeps profits and no revenue share follows launch. This is a platform contract, separate from the affiliate commission in the 1 July programme.

The relevant distinction is the contract: a buyer is offered infrastructure under a chosen brand, while a programme affiliate is promised a share.

The same crew advertised a smaller product on 18 August, in one line: an EDR killer for $550.

The 18 August offer advertises a tool intended to impair endpoint security before encryption. It is a separate intended function from generating a locker; no successful bypass was tested.

A third kind of offer is a kit listed for resale. On 6 March a Turkish-language channel listed the “open source” VanHelsing kit for 700 Telegram Stars. The text claims a $5,000 affiliate deposit, an 80% share and ransom demands of up to $500,000.

The edited catalogue classifies VanHelsing as a resale kit, separate from programme recruitment. It records 700 Stars and repeats programme claims. The catalogue does not establish a sales count.

A Tool Offer Does Not Supply the Way In

A builder, a source-code package and a programme seat solve different advertised tasks. The $50 offer describes a locker package; deploying any locker would still require access to a target system. The Gentlemen’s proof-or-deposit entry term makes that dependency explicit: the applicant may be expected to arrive with a prepared target.

The separate claim series cannot tie a builder price to an intrusion or to claim volume. It shows 33 groups active in at least eight months holding 5,950 claims, while 50 one-month groups hold 260. Those are observed persistence patterns, not evidence that low-priced tools created short-lived crews.

The practical consequence is to protect access and recovery as well as endpoints. Apply the CISA ransomware guide to exposed services, privileged accounts and tested backups. Asking amounts do not measure the cost of an incident or show how much an attacker spent.

Evidence and Scope

This article uses the edited 60-item ransomware catalogue and the collected relay series for 1 January–27 October 2026. Catalogue dates are first-seen dates.

The selection is not a market census; programme descriptions, advertised terms and claims are different evidence units. The catalogue is an attributed account, not a fresh authentication of every original. October is partial and 22–28 July is sampled.

A claim is one canonical group–victim pair. The 9,203-claim series excludes 190 0APT claims and removes 171 spelling-variant duplicates. A repeated relay post is not independent confirmation. Asking terms do not establish payments, delivery or tested effectiveness.

AI-Assisted Preparation

Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.

Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.

Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.

Brandefense analysts reviewed and approved the findings.