In recent years, ransomware has been, and still is, one of the main cyber threats for organizations of all sizes across the world by causing availability disruption and producing elevated financial costs.

Ransomware groups are structured as modern organizations with departments, specific roles assigned to every operator, and a clear chain of command. The attacks are performed actively by humans and are indeed named human-operated ransomware attacks.

In cybersecurity, we often talk about humans as the weakest link for organizations because, without doing enough awareness activities, all the money spent on technologies and processes has a low impact on the overall security posture. However, we rarely discuss the human factor behind threat actors and how we can leverage it to better protect ICT infrastructures.