Sophos has a dedicated team that investigates, and often works with the targets of, ransomware attacks. The team can forensically reconstruct the events of an attack after the fact, and sometimes disrupt attacks while they’re still in progress. The Sophos Rapid Response team gets involved in cases when there’s a chance to stop or limit the harm, but sometimes the attack happens so fast, there’s nothing it can do, and the target must then decide whether or not to pay the ransom, at which point, Sophos is no longer involved.

That's where companies like Coveware come in. The company represents ransomware targets, as a high-stakes negotiator with their attackers. Coveware’s CTO Alex Holdtman confirmed our suspicion, that ransomware heavyweights are the primary driving factor in the demand for sky-high ransoms.