One of the things I think companies miss is they tend to think these criminal threat actor groups are all independent and competing against each other.
These organizations sometimes share data and intelligence about victims. Once data is exfiltrated from a company and posted or sold on a dark-web forum, other criminal threat actors are using that data from another actor’s previous attack to stair-step to additional victims and further exploits.
With the advent of Ransomware-as-a-Service and Dark-Web malware shopping sites, like Silk Road and AlphaBay, the double extortion threat is real, and the threats are not just coming from single organizations, but sometimes criminal groups working together offering a malware service and Botnets to deploy the malware.