Yes, #1 or #2 are a given/implied but many ransomware operators don't make that much money when they don't get paid and even their ransom isn't usually $1M+. Y

Yes, #1 or #2 are a given/implied but many ransomware operators don't make that much money when they don't get paid and even their ransom isn't usually $1M+. You can use information to make money, ever heard of insider trading and extortion? Or straight up get on the treasury guy's pc and make payment transfers and approve purchasing orders to yourself. With operations like that, once they get it in a bank account they own, they pay mules to get it in cash in small chunks before the swift gets reversed, hopefully having multiple banks in the process will give them a week or more.