In recent years, ransomware has been, and still is, one of the main cyber threats for organisations of all sizes across the world by causing availability disruption and producing elevated financial costs.

Ransomware groups are structured as modern organisations with departments, specific roles assigned to every operator, and a clear chain of command. The attacks are performed actively by humans and are indeed named human-operated ransomware attacks.

In cybersecurity, we often talk about humans as the weakest link for organisations because, without doing enough awareness activities, all the money spent on technologies and processes has a low impact on the overall security posture. However, we rarely discuss the human factor behind threat actors and how we can leverage it to better protect ICT infrastructures.