What is Ransomware as a Service (RaaS)? How the Criminal Model Works
Ransomware as a Service (RaaS) is a criminal business model that separates ransomware development from ransomware deployment, enabling people with little to no technical skill to conduct sophisticated ransomware attacks. A RaaS developer builds and maintains the malware, the encryption infrastructure, the victim negotiation portal, and the data leak site. Affiliates, paying customers who rent access to this infrastructure, conduct the actual intrusions and deploy the ransomware. Revenue is split, typically 70-80% to the affiliate and 20-30% to the RaaS developer.
This model industrialized ransomware. Before RaaS, ransomware attacks required coding skill and infrastructure knowledge. With RaaS, anyone who can conduct an initial access intrusion can launch enterprise ransomware attacks. The result has been an explosion in attack volume, target breadth, and ransom demands.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts — distilled for practitioners. 50,000+ subscribers. No noise.
How the RaaS Criminal Model Works
RaaS operations function as professional criminal businesses. Developers maintain the core technology: the ransomware binary, the key management infrastructure (so encryption keys are server-side and cannot be recovered without paying), the victim negotiation portal (a Tor hidden service where victims communicate with attackers), and the data leak site (where stolen data is published if victims refuse to pay).
Affiliates are recruited through darknet forums. They pay either a subscription fee or receive the ransomware for free in exchange for a revenue-share percentage. To maintain quality and avoid attention, some RaaS groups screen affiliates: requiring demonstrated intrusion capability, ruling out attacks on healthcare or critical infrastructure (to reduce law enforcement pressure), and prohibiting attacks in certain geographies (typically Russia and neighboring countries where the developers are based).
When an affiliate successfully deploys the ransomware, the developer's key management server generates the decryption key and holds it until a ransom is paid. Victims who pay receive a decryptor. Victims who do not pay within a deadline have their stolen data published. This double extortion model (ransomware plus data theft) emerged around 2019 and is now the standard for sophisticated groups.
The RaaS Attack Chain
RaaS attacks follow a consistent playbook that has been documented across hundreds of incident response cases.
Initial access is obtained via phishing emails targeting credentials or delivering loaders, exploitation of internet-facing vulnerabilities (VPN appliances, remote desktop services, and unpatched web applications are consistently targeted), or purchasing access credentials from initial access brokers who specialize in selling footholds to other criminals.
Post-compromise, the affiliate conducts network reconnaissance, escalates privileges (commonly via Kerberoasting, credential dumping from LSASS, or exploiting misconfigured AD delegation), and achieves domain admin rights. This phase typically takes days to weeks in dwell time before encryption begins.
Data exfiltration precedes encryption. Affiliates stage and exfiltrate valuable data to cloud storage (Mega, AWS S3) before deploying the ransomware, ensuring the double extortion threat is credible.
Deployment of the ransomware encryptor is the final stage. Sophisticated operators use legitimate remote management tools (PsExec, Group Policy, Windows Admin Shares) to deploy the encryptor simultaneously to all reachable systems, maximizing damage before defenders can respond.
Key RaaS Groups Operating Today
LockBit was the most prolific RaaS operation from 2022 through early 2024, claiming more than 2,000 victims before law enforcement disruption in February 2024. The group continued operating post-takedown under LockBit 3.0.
Cl0p (TA505) distinguished itself through mass exploitation of zero-day vulnerabilities in managed file transfer products: MOVEit (2023), GoAnywhere (2023), and Accellion FTA (2021). Rather than deploying encryptors, Cl0p typically focused exclusively on data theft and extortion, targeting hundreds of organizations simultaneously from a single vulnerability campaign.
ALPHV/BlackCat operated a technically advanced Rust-based ransomware with cross-platform (Windows, Linux, VMware ESXi) capability. The group was disrupted by the FBI in December 2023 but reformed under various successor identities.
Dark Angels and Hunters International are among the active groups as of 2025. The RaaS ecosystem is fluid: groups are disrupted by law enforcement, rebrand, or have their source code leaked and reused by competitors. Tracking specific group attribution matters less than understanding the consistent TTPs the model produces.
Defenses That Actually Reduce RaaS Risk
Given the RaaS attack chain, the most effective defenses address the consistent entry points and dwell-time activities across groups.
For initial access: phishing-resistant MFA on all remote access and email accounts eliminates credential phishing as an entry vector. Timely patching of internet-facing systems (VPN appliances, web applications, remote desktop) reduces exploitation exposure. External attack surface monitoring identifies exposed services before attackers do.
For lateral movement and privilege escalation: tiered Active Directory administration (no accounts with both domain admin rights and email access), Kerberoasting detection in your SIEM, and LSASS protection via Credential Guard significantly raise the difficulty of achieving domain admin.
For dwell time detection: EDR behavioral detection for the tools affiliates consistently use (Cobalt Strike, AnyDesk, Rclone for exfiltration, Volume Shadow Copy deletion) surfaces intrusions during the reconnaissance phase rather than at encryption. Network monitoring for anomalous data egress detects exfiltration before ransom demands arrive.
For impact limitation: offline, air-gapped backups tested for restoration are the only reliable recovery option when encryption succeeds. Network segmentation limits the blast radius of a successful deployment.
The bottom line
RaaS succeeded by lowering the technical barrier for ransomware attacks while professionalizing the criminal support infrastructure. The consistent attack chain it produces (initial access via phishing or vulnerability exploitation, domain compromise, data exfiltration, then encryption) means defenders can prioritize specific controls that address each stage rather than trying to prevent every possible attack. Phishing-resistant MFA, timely patching, EDR behavioral detection, and offline backups are the controls with the highest consistent impact against the RaaS model.
Frequently asked questions
Should companies pay ransomware demands?
The FBI and CISA recommend against paying ransoms, as payment funds criminal operations and does not guarantee data recovery or the non-publication of stolen data. Practically, the decision depends on whether viable backups exist, the business impact of downtime, and whether the stolen data creates regulatory or liability exposure. Organizations should make this decision with legal counsel before an incident, not under pressure during one. Paying does not remove extortion risk: some groups re-extort victims months after initial payment.
What is double extortion in ransomware?
Double extortion is the RaaS tactic of combining file encryption with data theft. Attackers steal sensitive data before deploying the encryptor, then threaten to publish it on a public leak site if the ransom is not paid. This creates extortion pressure even for organizations with working backups, since restoring from backup does not prevent the publication of stolen customer data, intellectual property, or regulated information.
Can ransomware be decrypted without paying?
Occasionally. Law enforcement operations have seized RaaS infrastructure and published decryption keys for victims. The No More Ransom project (nomoreransom.org) maintains a repository of free decryptors for specific ransomware families. However, for active, sophisticated RaaS groups, decryption without the attacker-controlled key is not currently feasible. Organizations that restore from backup rather than paying are not 'decrypting' encrypted files; they are replacing them with unencrypted copies from before the attack.
What is the difference between ransomware and RaaS?
Ransomware is the malware category: software that encrypts victim files and demands payment for the decryption key. Ransomware as a Service is the distribution and business model: a criminal marketplace where ransomware developers license their tools to affiliate operators who conduct the actual attacks. Not all ransomware is deployed via RaaS (some groups use their own tools exclusively), but the majority of enterprise ransomware incidents today trace to RaaS affiliate operators.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.