Researchers at McAfee continue their analysis of the Sodinokibi Ransomware by following affiliate’s trail of money based on transaction IDs posted by the affiliate. Researchers were able to follow the money trail for affiliates and in some cases, how they spend their illicit earnings. McAfee was able to see other ransomware payments being made and the 60/40 or 70/30 revenue split between the affiliate and the RaaS operators. One of the larger affiliates had a wallet containing 443 BTC or approximately $4.5 million USD showing that they are a big player.
Source: https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-following-the-affiliate-money-trail/