Ransomware as a Service (RaaS) Explained

Ransomware has become a business, and like any business, it has found a way to scale. Instead of every attacker writing their own malware, a growing share of ransomware is now rented out on a subscription basis to anyone willing to pay. This model, known as Ransomware as a Service, helps explain why attacks have become so widespread. This post breaks down what RaaS is, how ransomware works, the groups behind it, the challenges it creates for defenders, and what organizations can do about it.

What Is Ransomware as a Service (RaaS)?

Ransomware as a Service (RaaS) is a cybercrime business model in which ransomware developers, often called operators, sell or lease their malware to other criminals known as affiliates. The affiliates then use it to launch their own attacks. It is essentially a notorious version of the software-as-a-service (SaaS) model, except the product on offer is intended for malicious use.

Kits are advertised on the dark web like products on a legitimate marketplace, with prices ranging from around $40 a month to several thousand dollars. Those amounts look trivial next to the enormous ransom demands in 2026, which IBM's Cost of a Data Breach Report puts at $4.99 million. An attacker does not need every attempt to succeed to come out ahead. 

The arrangement is mutually beneficial. Affiliates can profit from extortion without writing a line of malware, while developers earn more without breaking into networks, and they can profit from victims they might never have found on their own. 

IBM notes that ransomware is involved in 20% of cybercrime incidents, and that some of the most ill-famed strains, including LockBit and Black Basta, have spread through RaaS sales.

RaaS is illegal. Needless to say, buying kits on the dark web, breaking into a company network, stealing and encrypting files, and demanding payment from victims are all prohibited activities. But that doesn't stop attackers. Strong cybersecurity services stop them, and that is exactly what we offer.

How the RaaS Model Works

Two roles, one partnership: operators and affiliates. 

Operators develop and maintain the ransomware and its supporting infrastructure. They recruit affiliates on underground forums, give them a panel to build their own ransomware version, and provide a command-and-control dashboard to track results. Operators also set up the victim payment portal, offer help with negotiations, and run a leak site. 

Basically, they handle the technical part of the attack. 

Affiliates pay to use the ransomware and agree to a fee on each ransom collected. They choose their targets, set the ransom amount, and configure the message victims will see. They carry out the compromise, spread the infection using "living off the land" techniques, execute the ransomware, communicate with the victim through chat portals, and manage decryption keys.

Revenue Models That RaaS Use

Operators generally rely on one of four ways of getting paid:

• Monthly subscription: a flat recurring fee for access to the tools.
• Affiliate program: a monthly fee plus a share of any ransom collected.
• One-time license fee: the affiliate buys the code outright and shares no profits.
• Pure profit sharing: nothing up front, but the operator takes a significant cut of each ransom, often 30 to 40 percent.

A Service Experience That Mirrors Legitimate SaaS

The most sophisticated operators run their platforms like polished software businesses. An affiliate can create an account, pay in Bitcoin, specify the malware they want, and submit the request. Dashboards can show infection status, total payments, and the number of files encrypted. Subscribers may also get 24/7 support, bundled offers, documentation, feature updates, private forums for swapping tips, and tools for writing ransom notes and negotiating demands. Some operators even run marketing campaigns, with websites, videos, and white papers that look much like those of ordinary companies.

How Attacks Typically Begin

Once affiliates have the kit, they commonly launch phishing and social engineering campaigns to spread the malware. These techniques cost less than buying a zero-day exploit or a backdoor into a target. When the malware runs, it encrypts the victim's data and displays an on-screen message with ransom instructions.

Examples of RaaS

• LockBit: 

IBM describes LockBit as one of the most pervasive variants. It often spreads through phishing emails, and its operators have even tried to recruit affiliates who work inside their target organizations. It is advertised to Russian-speaking users or to English speakers vouched for by a Russian speaker. It quickly encrypts large businesses' systems, making it hard for IT teams to find and remove it in time.

• DarkSide: 

This operation was behind the 2021 Colonial Pipeline attack, which IBM calls the worst cyberattack on critical US infrastructure to date. Attackers stole roughly 100GB of data, and victims allegedly paid almost $5 million to a DarkSide affiliate. DarkSide first targeted Windows but expanded to Linux, hitting enterprises with unpatched VMware ESXi hypervisors. It shut down in 2021, and its developers later released a successor kit called BlackMatter.

• Black Basta: 

Emerging in 2022, it claimed over 100 victims across North America, Europe, and Asia within a short time, using targeted attacks and double extortion, demanding payment both to decrypt data and to keep sensitive information from being published.

• Dharma: 

Available on the dark web since 2016 and mainly associated with remote desktop protocol (RDP) attacks, Dharma is not centrally controlled. Most incidents examined were nearly identical, differing only in encryption keys, contact email, and a few customizable details, which means investigators learn little about who is behind any single attack.

Other kits include Locky, Goliath, Shark, Stampado, Medusa Ransomware, Encryptor, Jokeroo, etc. Operators regularly vanish, reorganize, and return with newer, better variants.

Cybersecurity Challenges of RaaS Attacks

Some of the business consequences a victim may face are as follows:

• Compliance issues, including possible fines for failing to meet required security standards.
• Downtime, which can halt operations and shake customer confidence.
• Lost data, especially without a backup.
• Attackers may demand payments repeatedly, which can be expensive and may raise insurance premiums later.
• Damaged credibility, as customers may leave a company that failed to protect their data.

Future of Ransomware-as-a-Service

The Colonial Pipeline attack showed how much harm criminals can cause; attacks on vital infrastructure are rising, and RaaS is likely to draw more criminals who want to replicate that scale of damage.

The tools themselves are also expected to become more sophisticated. One example is the ability to target different disk partitions, meaning that even if an organization hides critical data on a separate partition, RaaS-linked attackers may still reach and encrypt it.

In this situation, your business needs a rock-solid ransomware response plan now and in the future. Your business data should be your organization's top priority. 

Ways to Protect Against RaaS Attacks

Four core precautions that significantly contribute to ransomware attack prevention.

• Back up data regularly: 

Frequent backups reduce an attacker's leverage. Keep copies on external drives rather than relying only on cloud storage.

• Keep software updated: 

Update business applications and antivirus tools, because criminals exploit outdated systems whose known flaws newer versions have already fixed.

• Train staff continually: 

Teach employees to recognize, report, and quarantine suspicious messages, especially from unknown senders, and regularly cover social engineering and phishing techniques.

• Use endpoint protection and threat detection: 

Keep security tools up to date so defenses stay active 24/7.

• Build a comprehensive incident response plan:

Attribution is difficult, so responders cannot assume they know the attacker's tactics. Access brokers may linger on a network after an affiliate is removed, so proactive threat hunting and thorough investigation are needed to root them out.

• Use anomaly-based detection:

Endpoint detection and response (EDR) tools can spot signs such as unexpected backup deletions or sudden encryption processes, sometimes before the attack fully unfolds.

• Shrink the attack surface: 

Run frequent vulnerability assessments and apply patches, and consider tools such as SIEM, SOAR, and XDR to intercept threats faster.

• Control access: 

Use multifactor authentication (MFA), zero-trust architecture, and network segmentation to keep ransomware away from sensitive data.

ER Tech Pros’ Comprehensive Cybersecurity Services to the Rescue

Ransomware-as-a-Service has turned extortion into a scalable, subscription-driven industry. Developers build and maintain the tools, affiliates carry out the attacks, and both profit, while specialization has made attacks faster and attribution harder. 

The encouraging news is that the fundamentals still work. Tested backups, prompt patching, trained employees, strong access controls, strong detection, and a well-rehearsed response plan make an organization a much harder, less appealing target. 

ER Tech Pros offers comprehensive ransomware protection strategies that help your organization defend against threats regularly.