Affiliates pay a monthly Elfe and share a small percentage of any ransom payments that they receive with the operators. Stage 4: Data collection and exfiltration Here the ransomware operators switch focus to identifying valuable data and exfiltrating (stealing) it, usually by download