Ransomware as a Service (RaaS): How the Business Model Works

Ransomware as a service is a criminal franchise: developers build the ransomware and the payment and leak-site infrastructure, then rent it to affiliates who break into victims and share each ransom with the developers. Picture a finance manager arriving Monday to find every file locked by a crew that bought its tools and its way in.

RaaS vs Traditional Ransomware

Older ransomware gangs did everything themselves: wrote the code, broke in, negotiated and laundered the money. RaaS splits those jobs between specialists. The developers focus on the malware and the back end, while affiliates focus on intrusions. The US Department of Justice described the Hive group in exactly these terms in January 2023: administrators built the strain and an easy-to-use interface, then recruited affiliates who earned a percentage of each successful ransom. That division of labor is why one RaaS brand can run hundreds of attacks at once.

The RaaS Attack Chain, Step by Step

Step 1: Operators Build the Ransomware and Infrastructure

The operators maintain the encryptor, an affiliate control panel, payment and negotiation portals, and a data leak site on the dark web. LockBit, for example, also gave affiliates a custom data theft tool called Stealbit, according to the UK National Crime Agency (NCA).

Step 2: Affiliates Are Recruited and Onboarded

Operators advertise on criminal forums, vet applicants and give approved affiliates access to the panel. Some programs demand proof of past intrusions before granting access.

Step 3: Initial Access Brokers Sell a Way In

Many affiliates skip the hard part by buying access from initial access brokers, who sell stolen VPN logins, exposed remote desktop (RDP) sessions or footholds left by earlier malware. CISA advisories on Hive listed single-factor RDP and VPN logins and phishing emails among common entry points.

Step 4: Affiliates Deploy the Attack

Inside the network, affiliates escalate privileges, move laterally, steal data, delete or encrypt backups, and then launch the encryptor across as many systems as possible, often at night or on a weekend.

Step 5: Ransom Negotiation, Payment and Revenue Split

The victim is pointed to a negotiation portal. Payment is demanded in cryptocurrency for a decryptor and a promise not to publish stolen data. The operators then take their agreed cut and the affiliate keeps the rest.

RaaS Revenue Models

Monthly Subscription

Some services charge a flat recurring fee for access to the ransomware and panel, regardless of how many victims pay.

One-Time License

Other sellers offer a lifetime license for a single upfront payment, usually with fewer support features.

Affiliate Profit Sharing

The most common model. There is no upfront fee; the operators take a share of every ransom paid and the affiliate keeps the larger portion. Exact splits vary by group and change over time, so treat any single figure you see online with caution.

Who Is Involved in the RaaS Ecosystem?

• Operators or developers build and run the platform.
• Affiliates carry out intrusions and deployments.
• Initial access brokers sell entry into victim networks.
• Negotiators handle victim communications for some groups.
• Money launderers move and cash out cryptocurrency.

Notable RaaS Groups From Official Reports

LockBit

CISA’s joint advisory AA23-165A, using FBI data, linked LockBit to about 1,700 attacks on US organizations since 2020 and roughly $91 million in ransoms paid in the US.

ALPHV/BlackCat

CISA’s StopRansomware advisory AA23-353A covers ALPHV/BlackCat, an affiliate-driven operation whose indicators and techniques the agency published for defenders.

RansomHub

According to CISA advisory AA24-242A, RansomHub had hit at least 210 victims since February 2024, drawing in affiliates from disrupted groups.

Medusa

CISA advisory AA25-071A says Medusa was first identified in June 2021 and moved to an affiliate model by at least early 2023.

Hive

The DOJ said in January 2023 that Hive had targeted more than 1,500 victims in over 80 countries since June 2021 and received over $100 million in ransom payments.

Why RaaS Makes Ransomware Harder to Stop

Lower Skill Barrier for Attackers

An affiliate does not need to write malware. With purchased access and a rented toolkit, a modestly skilled criminal can run an enterprise-grade attack.

Double Extortion and Data Leak Sites

Groups steal data before encrypting it, then threaten to publish it. Backups alone no longer remove the pressure to pay, because the data has already left the building. The NCA found data from victims who had paid LockBit still sitting on its systems, evidence that payment does not guarantee deletion.

Affiliates Moving Between Groups After Takedowns

When a brand falls, its affiliates often join another. Sophos has reported that DragonForce, a RaaS group active since 2023, rebranded as a “cartel” in March 2025 and began letting affiliates run attacks under their own brands on its infrastructure. Shifts like this mean defenses must target affiliate techniques, not just brand names.

How Law Enforcement Is Disrupting RaaS

Takedowns show RaaS platforms are vulnerable. In the Hive case, announced by the DOJ on January 26, 2023, the FBI covertly infiltrated the group’s network from July 2022, gave more than 300 decryption keys to victims under attack and over 1,000 to earlier victims, and prevented about $130 million in ransom payments before seizing Hive’s servers with German and Dutch partners.

On February 20, 2024, the NCA revealed Operation Cronos against LockBit. Working with the FBI and partners from nine other countries, it took control of LockBit’s administration environment and leak site, obtained its source code and more than 1,000 decryption keys. In wider action coordinated by Europol, two LockBit actors were arrested in Poland and Ukraine and more than 200 cryptocurrency accounts were frozen.

How to Protect Your Business From RaaS Attacks

Close Common Entry Points (Phishing, RDP, VPN, Unpatched Software)

Remove RDP from the internet, patch VPN appliances quickly and filter malicious email. Prioritize flaws on CISA’s Known Exploited Vulnerabilities catalog.

MFA and Identity Protection

Require phishing-resistant MFA on remote access, email and admin accounts. Stolen single-factor logins are among the cheapest items initial access brokers sell.

EDR and 24/7 Monitoring

Affiliates often spend days inside a network before encrypting. EDR with round-the-clock monitoring, in-house or managed, gives you a chance to catch them during that window.

Offline, Immutable Backups and an Incident Response Plan

Keep at least one backup copy offline or immutable, test restores and write down who decides what during an incident. Ransomware as a service crews target backups first, so assume they will look for yours.

What to Do If You Are Hit by RaaS (US and UK Reporting)

Isolate affected systems without wiping them, preserve logs and call your incident response provider and insurer. In the US, report to the FBI through IC3 or a local field office and check CISA’s StopRansomware resources; payments may also carry OFAC sanctions risk. In the UK, report through the government’s Cyber Incident Signposting Service or Action Fraud, follow NCSC ransomware guidance and notify the ICO within 72 hours if personal data is involved. Confirm specific obligations with counsel.

Would Your Network Survive a Rented Attack?

Ransomware as a service turns one toolkit into hundreds of attacks, so your odds depend on how cheaply a criminal can buy a way into your network. Ask yourself whether an affiliate with a stolen VPN password could reach your backups today. If you are not sure, start by enforcing MFA on remote access this week. To find where an affiliate would get in, contact Cyber Security Solutions Ltd through our contact page.