Affiliates pay a monthly Elfe and share a small percentage of any ransom payments that they receive with the operators. Stage 4: Data collection and exfiltration Here the ransomware operators switch focus to identifying valuable data and exfiltrating (stealing) it, usually by downloading or exporting a copy for themselves. First seen in 2018,