Ransomware-as-a-service (RaaS) is a criminal business model in which developers build and maintain ransomware, then rent it to affiliates who carry out the attacks, splitting the proceeds. It works like a software subscription for crime.
The model, explained
Ransomware-as-a-service applies the logic of the legitimate software-as-a-service industry to crime. In the legitimate world, a company builds software once and rents access to many customers rather than selling a one-off product. RaaS does the same with ransomware. A small number of skilled developers, the operators, build and maintain the malware, the encryption, the payment and negotiation infrastructure, and the leak sites. They then rent all of it to a larger pool of less-skilled criminals, the affiliates, who use it to attack victims and share the ransom with the operators.
The economics are usually a revenue split. The affiliate who carries out an attack typically keeps the majority of any ransom, while the operator takes a cut, often around 20 to 30 percent, for providing the tools and infrastructure. Some operations also charge subscription fees or sell access tiers. The result is a layered criminal supply chain that mirrors a real business, complete with support, documentation, and even reputation systems on criminal forums.
Why it has driven the explosion in attacks
RaaS is the single biggest reason there are so many ransomware groups and attacks today. Before it, launching a damaging ransomware campaign required the ability to write reliable malware, manage cryptocurrency payments, and host leak infrastructure, a high bar that limited the number of capable attackers. RaaS removed that bar. Now an attacker needs only the ability to break into networks; the hard technical parts are rented, ready-made.
This specialization has industrialized the threat. It separates the skill of intrusion from the skill of building ransomware, letting each group focus on what it does best, and it scales the number of attacks dramatically. It also explains the churn in group names that defenders see: operations rebrand, split, and reform constantly, and the same affiliate may use different ransomware from one attack to the next.
What it means for defenders
The RaaS model has a direct and important implication for how organizations defend themselves. Because the operator, the affiliate, and the specific ransomware behind any given attack change constantly, defenses built around recognizing a particular group or a specific malware signature are always a step behind. The branding on the ransom note is not a stable thing to defend against.
What stays consistent is the shape of the attack. Regardless of which RaaS kit is used, the affiliate still has to gain initial access, explore the network, escalate privileges, move laterally, steal data, disable defenses, and encrypt. Those behaviors are common across virtually all ransomware, which is why behavior-based detection, rather than signature matching, is the more durable defense. An approach that watches for the actions of an attack catches a brand-new RaaS affiliate just as readily as a known one.
The affiliate access economy
RaaS sits alongside a related criminal market that makes it even more potent: the sale of initial access. Specialist criminals known as initial access brokers compromise organizations and then sell that access to ransomware affiliates, who no longer even need to perform the break-in themselves. A RaaS affiliate can effectively buy a foothold in a target, rent the ransomware to deploy, and use the operator's infrastructure to collect the ransom, assembling a full attack from purchased components.
For a defender, this interconnected economy reinforces the same lesson. You cannot predict which group, which kit, or which broker will be involved, so resilience has to come from covering the whole attack chain: hardening against initial access, detecting lateral movement and exfiltration by behavior, containing an intrusion before it spreads, and being able to recover from immutable backups so a successful attack does not force a payment that funds the next round of the RaaS economy.
Why RaaS keeps reinventing itself
One of the most frustrating features of the RaaS ecosystem, from a defender's point of view, is how resistant it is to disruption. When law enforcement takes down a prominent operation or when a group's reputation collapses after it fails to deliver a promised decryption key, the people behind it rarely disappear. They rebrand, relaunch under a new name, and carry on, often reusing much of the same code and infrastructure. Affiliates simply move to whichever operation offers the best tools and the most favorable revenue split, much as contractors move between employers.
This fluidity is why counting or naming groups gives a misleading picture of the threat. The brand on a ransom note is a marketing label that can change overnight, while the underlying capability, the people, the code, the access, persists and recombines. For an organization deciding how to defend itself, the practical implication is to stop treating any particular group as the thing to defend against and instead invest in defenses that work no matter who is on the other end: behavior-based detection, segmentation to limit spread, and recovery that does not depend on identifying the attacker. Those hold up across every rebrand.
See also
Sources
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.