What is ransomware as a service (RaaS)?

Ransomware as a service (RaaS) is a cybercrime business model in which ransomware developers, known as operators, build and maintain ransomware and lease it to other criminals, known as affiliates, who carry out the actual attacks in exchange for a share of the proceeds. It's a criminal mirror of the legitimate software-as-a-service (SaaS) model: instead of every attacker writing their own malware, operators handle the hard technical work, developing the ransomware, running the infrastructure, hosting payment portals and leak sites, while affiliates focus on breaking into targets and deploying the payload. The result is a professionalized underground economy, complete with subscriptions, affiliate portals, dashboards, user reviews, and 24/7 support. By separating development from deployment, RaaS dramatically lowers the technical barrier to entry, letting people with little or no coding skill launch sophisticated ransomware attacks. That division of labor is a major reason ransomware has exploded in scale and frequency.

Key takeaways

RaaS is a criminal SaaS business model. Operators develop and lease ransomware; affiliates deploy it and share the ransom.
It lowers the barrier to entry. Attackers no longer need to write code, so far more people can launch sophisticated attacks.
Roles are specialized. Operators, affiliates, and initial access brokers (IABs) each play a distinct part, which speeds up attacks.
It's resilient by design. Catching one affiliate doesn't shut down the operator, and groups rebrand to evade law enforcement.
Double extortion is now standard. Affiliates steal data before encrypting, then threaten to leak it, so backups alone are no longer enough.

How RaaS works: operators, affiliates, and access brokers

The RaaS ecosystem runs on specialization, with responsibilities split across distinct roles:

Operators (developers): Build and maintain the ransomware and its entire back end: encryption tooling, affiliate portals and dashboards, payment processing (usually in cryptocurrency), leak sites, and victim-negotiation platforms. They also recruit and vet affiliates and provide support and updates.
Affiliates: The customers who conduct the attacks. They select targets, gain initial access, move laterally, exfiltrate data, and deploy the ransomware. They're often not skilled developers; they rely on the operator's tools.
Initial access brokers (IABs): A third specialty: criminals who infiltrate networks and sell ready-made access to affiliates, letting them skip reconnaissance and deploy immediately.

Operators advertise on dark web forums, run marketing campaigns, and recruit affiliates, sometimes pouring significant sums into recruitment. Once an affiliate joins, they receive not just the malware but a genuine service experience: onboarding, documentation, feature updates, and support that mirrors legitimate SaaS. This division of labor is exactly why RaaS attacks have accelerated.

RaaS revenue models

RaaS operators monetize their kits through several arrangements. Affiliates choose based on budget and risk appetite.

Model	How it works
Affiliate / profit-share	The most common model. No upfront cost; the operator takes a cut of every ransom, often around 30–40% (arrangements vary widely).
Monthly subscription	Affiliates pay a recurring fee, sometimes as low as a few tens of dollars per month, for access to the tools and support.
One-time license	A single flat fee for unlimited use of the ransomware, typically with limited or no ongoing support or updates.
Tiered packages	Different service levels (like SaaS plans), with higher tiers offering better evasion, anonymization, or features.

Payments are made in cryptocurrency to preserve anonymity. The economics are compelling for criminals: kits can cost as little as a modest monthly fee, while ransom demands routinely reach six or seven figures. An affiliate doesn't need every attack to succeed to profit.

The RaaS attack lifecycle

Development: The operator builds and refines the ransomware and its infrastructure, focusing on reliable encryption and detection evasion.
Recruitment: The operator advertises on dark web forums (such as RAMP, Exploit, and XSS) and vets affiliates, sometimes requiring proven track records or specific skills.
Initial access: The affiliate breaks in via phishing, by exploiting exposed services or unpatched vulnerabilities, by brute-forcing weak credentials, or by buying access from an IAB.
Deployment: The affiliate moves laterally, exfiltrates sensitive data, and executes the ransomware to encrypt systems.
Extortion: A ransom note directs the target to a Tor negotiation portal. Double (and triple) extortion adds pressure via threatened data leaks and other tactics.
Payout and split: If the target pays in cryptocurrency, the proceeds are divided between affiliate and operator per their agreement.

Why RaaS is so dangerous and resilient

RaaS is more threatening than traditional, self-contained ransomware for structural reasons. It scales: instead of one group attacking targets, many affiliates deploy the same ransomware in parallel, widening reach dramatically. It's resilient: because roles are separated, catching an affiliate doesn't dismantle the operator, and if an operator is disrupted, affiliates simply switch to another kit. And it evades accountability through rebranding: groups reorganize under new names to escape law enforcement and sanctions, as when the sanctioned Evil Corp renamed its ransomware to keep payments flowing.

This separation of tools, initial access, and payload also makes attribution genuinely hard. The people carrying out an attack are often not the people who wrote the malware, so pinning a campaign on a specific group takes real intelligence work.

Notable RaaS operations

Many of the most damaging ransomware families operate as RaaS. Prominent examples include:

Reveton (circa 2012): Widely considered one of the earliest RaaS precursors, using law-enforcement impersonation to extort targets.
REvil / Sodinokibi: A highly active operation known for the affiliate model and very large ransom demands, behind major attacks in 2021.
DarkSide: Professionalized branding and a "code of conduct"; responsible for the 2021 Colonial Pipeline attack, later relaunching as BlackMatter.
Conti: Operated like a corporation, with managers, payroll, and performance reviews, before disbanding.
LockBit: One of the most prolific RaaS variants for years, responsible for thousands of attacks before major disruption.
Mallox (TargetCompany): A long-running RaaS targeting unsecured MS-SQL servers; Sekoia's TDR team has first-hand research on it from a live honeypot investigation.
Newer operations (RansomHub, Qilin, Akira): Among the most active groups in 2024 and 2025, illustrating how the market constantly regenerates as older groups fall.

How to defend against RaaS

Because RaaS is ransomware packaged for easier use, the defenses are the fundamentals of ransomware resilience, applied rigorously:

Close initial-access routes: Patch internet-facing systems, harden or remove exposed services (RDP, VPNs, databases), and enforce strong credentials with MFA to defeat the phishing, exploitation, and brute-force that affiliates rely on.
Deploy behavioral detection and response: Use EDR/XDR to catch post-access behaviors (lateral movement, data staging, shadow-copy deletion, mass encryption) rather than relying on signatures for an ever-changing payload.
Maintain offline, tested backups: Keep immutable or offline backups and rehearse recovery, though note that double extortion means backups alone won't prevent a data-leak threat.
Watch for data exfiltration: Monitor for unusual outbound transfers that precede encryption in double-extortion attacks.
Use threat intelligence: Track active RaaS operations, affiliate TTPs, and IABs so detection is informed by how these groups actually operate.

Expert insight: Track the operation, not just the payload

RaaS demands a shift in how you think about defense. Because the same ransomware is deployed by many different affiliates, each with their own tradecraft, detection built around a payload alone will fail: the payload changes, affiliates vary, and operators rebrand. What's far more durable is intelligence on the operation itself: who the operators and affiliates are, which forums they recruit on, which initial access brokers feed them, and which techniques each affiliate favors. Detection has to focus on the behaviors of the attack chain (initial access, lateral movement, data staging, encryption prep), because those persist even as the branded payload mutates.

Sekoia's Threat Detection & Research team monitors the RaaS ecosystem directly, tracking affiliate-recruitment activity on cybercrime forums such as RAMP, Exploit, and XSS, and publishing analysis of the most prominent RaaS programs. The team also produces first-hand research on specific operations: its investigation of the Mallox RaaS via an MS-SQL honeypot identified two distinct affiliates and their differing tradecraft, exactly the operation-level intelligence that generic payload signatures miss. That research feeds native Sekoia Intelligence, so indicators and affiliate TTPs are correlated against customer telemetry on the Sekoia AI SOC platform and can be retro-hunted across historical events, while automated response can contain an affiliate's activity before encryption begins. As a European vendor with a data-sovereignty posture, Sekoia pairs this with the compliance sensitivity that double-extortion targets need. Defend against RaaS by tracking the operation and detecting the behaviors, not by waiting to recognize the payload.