Affiliate model: the operator develops the encryptor, the negotiation infrastructure and the leak site; the affiliate runs the intrusion. Typical splits leave 70-90% of the ransom to the affiliate. Programmes have vetting rules, operating manuals, technical support and even 'customer service' for victims who pay.
What is RaaS?
RaaS (Ransomware as a Service) is a criminal business model in which an operator group develops and maintains the ransomware platform —the encryptor, the management panel, the negotiation portal and the leak site— and rents it to affiliates who carry out the intrusions in exchange for a share of the ransom, typically 70% to 90% for the affiliate. It mirrors the legitimate SaaS model: the operator provides the product and the infrastructure; the affiliate provides the labour. The consequence is that attacking with ransomware no longer requires knowing how to write it: it is enough to buy an access, follow the affiliate programme's playbook and split the proceeds.
Why does it matter?
Because RaaS is the reason ransomware went from artisanal crime to industry. Layered specialisation multiplies attack volume: Initial Access Brokers sell ready-made accesses (VPNs without MFA, exposed RDP, credentials stolen by infostealers), affiliates exploit and deploy, and the operator gets paid without ever touching a victim directly. The Conti leaks of 2022 revealed an organisation with payroll, HR, shifts and departments, like any software company. Brands such as LockBit or ALPHV/BlackCat compete for affiliates by offering better revenue splits and tooling, and they survive law enforcement blows —Operation Cronos dismantled LockBit infrastructure in February 2024— through rebranding and affiliate migration to other programmes. For defenders there is a practical consequence: dozens of affiliates share the same programme tooling and TTPs, so behaviour-based detection mapped to MITRE ATT&CK and solid threat intelligence on active programmes pay off far more than chasing individual malware samples.
Key points
Initial Access Brokers (IABs): an upstream market sells validated initial accesses —VPNs without MFA, exposed RDP, webshells, compromised credentials harvested by infostealers— for hundreds to thousands of dollars. The person who breaks into the network and the one who encrypts it are rarely the same.
Double and triple extortion: before encrypting, the affiliate exfiltrates data and the operator publishes a countdown on its leak site; if the victim restores from backups, the leverage shifts to data exfiltration. Triple extortion adds DDoS, calls to the victim's customers or reports to regulators. Backups alone no longer neutralise the extortion.
Support ecosystem: crypters to evade antivirus, bulletproof hosting, loader developers, negotiators and laundering through cryptocurrency mixers. Every link is a hireable service, which lowers the barrier to entry and makes the chain resilient to the takedown of any single provider.
Brands, reputation and rebranding: RaaS programmes compete for affiliates and weaponise their brand against victims ('you know LockBit publishes'). After a police operation or an internal exit scam against affiliates, the programme dissolves and re-emerges under a new name, inheriting code, staff and methods.
Defensive implication: because affiliates share a playbook, the techniques repeat: access via credentials or phishing, privilege escalation, lateral movement, exfiltration with tools like rclone and encryptor deployment out of hours. Detecting those phases with EDR and monitoring buys days of margin before encryption.
Example: anatomy of a double-extortion RaaS attack
An infostealer on an employee's personal laptop steals the corporate VPN credentials, which have no MFA. Weeks later those credentials surface on a criminal marketplace, where an Initial Access Broker validates them and sells the access for 2,500 dollars. The buyer is an affiliate of a RaaS programme: he logs in through the VPN, escalates privileges via an unpatched server, obtains domain admin credentials and spends ten days moving laterally, mapping the backups and the most sensitive data. Before encrypting anything, he exfiltrates 300 GB to cloud storage with rclone. On a Saturday at 3 a.m. he wipes the reachable backups and launches the operator's encryptor against the servers.
The ransom note points to the operator's negotiation portal, where a 'manager' staffs the chat, and the leak site lists the company with a ten-day countdown. The operator keeps 20% of the ransom; the affiliate takes the rest; the IAB was paid long ago. Three different actors, one attack. In the defensible version of this story, the exposed attack surface was smaller, the VPN enforced MFA, the EDR flagged the credential dumping on day two, and the incident response team cut the intrusion during lateral movement — eight days before an encryption that never happened.
Common mistakes
- Believing your company is too small to interest a ransomware group. Affiliates buy accesses in bulk on IAB marketplaces; targeting is opportunistic and automated, not a bespoke operation you can dismiss on size.
- Betting the whole strategy on backups. Restoring solves the encryption, not the extortion: with double extortion the leverage is the publication of stolen data, which calls for leak prevention, encryption of sensitive data and a communications plan, not just copies.
- Treating ransomware as 'malware that arrives by email'. It is a human-operated intrusion that dwells in the network for days or weeks before encrypting; every earlier phase (access, escalation, lateral movement, exfiltration) is a detection opportunity wasted if you only watch for the final binary.
- Ignoring the initial access market: credentials in infostealer logs, VPNs without MFA and exposed RDP are exactly what IABs buy. Monitoring your own credential exposure is direct defence against RaaS.
- Not preparing the payment decision in advance: legal aspects, sanctions lists, cyber insurance, negotiators and business thresholds. Making that call for the first time with encrypted servers and a public countdown guarantees making it badly.
Related services
This concept may be related to services such as:
Frequently asked questions
I run IT at a mid-size company: how does a RaaS affiliate actually end up inside my network?
Through three main routes, all measurable. The first and most common: valid credentials bought from an Initial Access Broker, stolen by infostealers or via phishing, used against VPNs or remote services without MFA. The second: exploitation of vulnerabilities in exposed systems (VPN appliances, firewalls, mail servers) within days of the CVE being published. The third: RDP exposed to the Internet with weak passwords. The corresponding defence is direct: MFA on every remote access, priority patching of the perimeter, and monitoring of your credentials in marketplaces and leaks.
Why has RaaS multiplied the number of ransomware attacks?
Because it separates talent from volume. A group used to need its own developers, intruders, negotiators and money launderers; now each function is a hireable service and the affiliate programme scales like any platform: a single operator can have dozens of affiliates attacking in parallel, and each affiliate can buy ready-made accesses instead of earning them. The barrier to entry drops, volume rises and professionalisation deepens: manuals, support, brand reputation and profit-sharing audited by the operator's own panel.
If we have tested, immutable backups, does double extortion still affect us?
Yes, and it is important to accept that before the incident. Backups solve availability: you can restore without paying for the decryptor. But double extortion turns the stolen data into the main leverage: publication on the leak site, pressure on your customers and possible mandatory notification to the regulator if personal data is involved. The complete answer combines immutable backups, minimisation and encryption of sensitive data, DLP on critical repositories, exfiltration detection (anomalous volumes towards cloud storage) and a legal and communications plan prepared in advance.
Does it actually help when police dismantle a RaaS programme like LockBit?
It helps, though not as a knockout blow. Operations like Cronos (February 2024) seize infrastructure, recover decryption keys for victims, expose operator identities and, above all, destroy trust: affiliates fear the panel is compromised and law enforcement is reading their chats. The usual effect is dispersion —affiliates migrating to other programmes or launching new brands— rather than disappearance. For a company, the practical reading is that the threat is structural: your defence cannot depend on any one group falling, but on controls that work against any affiliate running the same playbook.