Ransomware-as-a-Service (RaaS)

Ransomware-as-a-service (RaaS) is a criminal business model in which a core group develops and maintains ransomware — the encryptor, the leak site, the payment and negotiation infrastructure — and rents it to "affiliates" who carry out the actual intrusions. Revenue is split, typically with the affiliate keeping the larger share of any ransom. It is the extortion-specific instance of malware-as-a-service, and it is the reason ransomware scaled from a specialist crime into an industry: the people breaking in no longer need to know how to write malware.

How it works

The division of labor mirrors legitimate software companies. Operators recruit affiliates on underground forums, publish documentation and rules of engagement, provide an admin panel for building payloads and tracking victims, and even run "support" for negotiations. Affiliates handle initial access — through phishing, stolen credentials, MFA-bypass social engineering, or exposed remote services — or simply buy a foothold from an initial access broker. Once inside, the affiliate escalates privileges, exfiltrates data, and detonates the encryptor; the operator's leak site then applies double extortion pressure, threatening publication if the ransom is not paid. When law enforcement dismantles one brand, affiliates migrate to another, which is why takedowns rarely reduce overall volume for long.

How to defend against it

Defending against RaaS means defending against its affiliates' entry methods, which are stubbornly human: phishing, credential theft, and persuading a help desk or an employee past MFA. Enforce phishing-resistant MFA and least privilege, patch or gate exposed remote access, segment networks, and keep offline, tested backups so encryption is a disruption rather than an existential event. Then harden the front door: train employees against the lures affiliates actually use and verify it works with realistic phishing simulations, because most ransomware incidents still start with a person, not an exploit. Tracking which teams fail those tests with a human risk score shows where an affiliate would get in first.