Why do two intrusions with the identical ransomware build show completely different tradecraft?

## The claim to correct A competent senior engineer will often say: the same payload means the same operator, so expect the same behaviour. Under a service model that is backwards. **Payload sameness with entry-path divergence is exactly what the model predicts.** ## What is shared and what is not Split one extortion event into two halves. **Shared product (comes from the platform):** - the encryptor and the builder that produced this victim's sample - per-victim key handling through the affiliate panel - the ransom note template and the negotiation desk - the leak infrastructure and the payment rails - often the extension, the note filename and the general shape of the final hour **Affiliate tradecraft (comes from whoever rented it):** - how entry was obtained: bought from a broker, phished, or through an internet-reachable service - how the estate was crossed and how noisy that was - how long they sat before acting - hours for some, weeks for others - what they judged worth taking, and how much of the estate they touched at all - their working hours, their language, their tolerance for risk, their competence One brand may have dozens of affiliates operating concurrently. Their only shared property is the last step. ## Why the divergence is *wild* rather than mild The platform exists to lower the skill floor. It supplies exactly the parts that are hard to write and easy to reuse, which means the range of people who can complete an extortion is enormous: from an operator who could have built their own encryptor and simply prefers not to spend the time, down to someone whose entire contribution was buying a listed credential and clicking through a panel. Both produce the same final artefact. The variance you see is variance in *people*, and a service model deliberately widens the pool of people. Affiliates also move between platforms. One crew can appear under two brands in the same quarter, and a brand can lose half its affiliates to a competitor offering a better split. So the mapping between brand and behaviour is not just loose, it changes over time. ## The inference discipline State the direction of each claim precisely: | What you have | What it supports | What it does not support | | --- | --- | --- | | The same encryptor build | The same platform was rented | The same crew ran the intrusion | | The same entry route twice | Possibly one affiliate, or one broker's stock | Anything about the brand | | A brand's published habits | What the platform supplies | What tomorrow's affiliate will do | The practical consequence: a defensive plan built from one write-up of "how this brand operates" is built on a sample of one affiliate. Hardening the specific entry path from the last case leaves the rest of the market's inventory untouched, because the next affiliate who rents that same platform may have bought something completely different. ## Where the inference does hold It is not that nothing generalises. The **shared** half generalises well: the final hour looks similar, because the product is the same, and the leverage layers are similar because the platform's business model is the same. And where an affiliate is *consistent*, their own habits repeat far more reliably than the brand does - which is why a repeated entry route across two victims is better evidence of a single affiliate or a single broker's stock than a matching payload ever is. ## The sentence to have ready "The encryptor is shared product and the intrusion is affiliate tradecraft, so one identical build behind two unrelated entry paths is the predicted signature of a rented platform, not a contradiction. Payload sameness supports 'same platform'; only behaviour supports 'same operator'."