Ransomware isn't just cybercrime anymore. Not because every operator has geopolitical ambitions. But because thousands of independent profit-driven decisions can collectively produce the strategic effects a hostile state wants. From the perspective of many ransomware operators, the objective is straightforward: Find a victim that can pay. Maximize profit. Avoid unnecessary attention. For some, ransomware is simply a business. For others, it's a way to survive. Geopolitics rarely enters the equation ( for RaaS groups ne-affiliated with states org ) Yet when ransomware crews consistently avoid domestic targets, operate from jurisdictions where they face little risk of prosecution, and repeatedly impact critical infrastructure in geopolitical rivals, the outcome becomes much larger than the intentions of any individual operator. No recruitment. No command-and-control. No formal agreement. Just aligned incentives. The criminals pursue profit. The state benefits from economic disruption, political pressure, and degraded public confidence in its adversaries. Neither side needs to coordinate when both benefit from the same outcome. In GN-089, I examine five mechanisms that explain how ransomware can evolve from a criminal business model into a hybrid warfare instrument: • Tacit tolerance instead of active sponsorship • Target steering without direct orders • Strategic timing around geopolitical events • Economic warfare as a byproduct of greed • Critical infrastructure disruption under criminal cover The most effective hybrid weapon isn't always the one a state builds. Sometimes it's the one it simply chooses not to stop. N ew GREY NEXUS Report (GN-089): Ransomware as Hybrid Warfare — When Criminal Business Models Serve Strategic Objectives. TLP:AMBER available too - to know how a RaaS operator thinks and what he does with details Read the full report, free, at aether-intel.com.