Stopping the ransomware epidemic is less about tackling individual crypto-locking malware variants and more about combating the entire ecosystem of bad actors underpinning digital extortion, the British government said Monday.

Behind any infection from name-brand ransomware such as LockBit or BlackCat lies a loose network of affiliates, initial access brokers and other actors, warned the U.K National Crime Agency and National Cyber Security Center in a white paper.

“While on the surface, an attack can be attributed to a piece of ransomware, the reality is more nuanced, with a number of cybercriminal actors involved throughout the process,” the agencies said.