What is Ransomware-as-a-Service (RaaS)? | Definition & Guide
Ransomware-as-a-Service (RaaS) is the business model through which ransomware developers provide their encryption tools, infrastructure, and operational support to affiliate operators in exchange for a percentage of ransom payments. Rather than a single threat actor handling everything from initial access to encryption to extortion negotiation, RaaS separates the operation into specialized roles: the core developer builds and maintains the ransomware payload, leak site, and negotiation infrastructure, while affiliates handle access acquisition, lateral movement, and ransomware deployment within target environments. RaaS groups like LockBit, ALPHV/BlackCat, and their successors operate with organizational structures resembling legitimate SaaS businesses — complete with affiliate portals, customer support for victims, and revenue-sharing agreements. This model has dramatically increased the volume of ransomware attacks by lowering the technical barrier to entry: affiliates do not need to develop ransomware capabilities, only the ability to gain and operationalize network access.
Definition
Ransomware-as-a-Service (RaaS) is a cybercrime business model in which ransomware developers license their tools, infrastructure, and operational support to affiliate operators who conduct the actual attacks. The RaaS operator maintains the ransomware payload (encryption software), the data leak site (where stolen data is published to pressure victims), the negotiation portal (where victims communicate with the attackers), and the payment infrastructure (cryptocurrency wallets and laundering mechanisms). Affiliates — who may be independent eCrime operators, former members of other ransomware groups, or operators who purchase initial access from IABs — use these tools to encrypt victim systems and exfiltrate data. Revenue is split between the operator and affiliate, with the affiliate typically receiving the majority share and the operator retaining a percentage for platform development and maintenance.
Why It Matters
RaaS transformed ransomware from a technical capability requiring significant development expertise into an accessible criminal service. Before the RaaS model, ransomware campaigns were conducted by vertically integrated groups that handled every phase — from malware development through distribution, encryption, and extortion. This limited the scale of operations to what a single group could manage. RaaS decoupled development from deployment, enabling dozens or hundreds of affiliates to conduct simultaneous campaigns using the same underlying tools.
The operational impact is measurable in attack volume. The proliferation of RaaS groups and their affiliate networks has made ransomware the dominant eCrime threat to organizations globally. CrowdStrike, Mandiant, and Unit 42 each track dozens of active RaaS operations at any given time, with new groups emerging to replace those disrupted by law enforcement.
For defenders, the RaaS model creates a detection and attribution challenge. Multiple affiliates using the same ransomware toolkit produce overlapping but distinct TTPs — they may use the same encryption payload but different initial access methods, different lateral movement techniques, and different exfiltration tools. Detecting the affiliate's pre-ransomware activity (credential theft, lateral movement, data staging) is more valuable than detecting the ransomware deployment itself, which typically occurs only after the adversary has already achieved their objectives.
The double extortion model — encrypting systems AND exfiltrating data for publication on leak sites — has become standard practice among RaaS operations. Even organizations with robust backup strategies face pressure to pay because the threat of data publication creates regulatory, legal, and reputational exposure beyond the operational disruption of encryption.
How It Works
The RaaS ecosystem operates through defined roles and processes:
-
RaaS operator infrastructure — The core developer builds and maintains the ransomware platform. This includes the encryption payload (designed to be configurable by affiliates — target specific file types, set encryption speed vs. stealth tradeoffs, deploy across Windows and Linux), the leak site (a Tor-hosted website where victim data is published in stages to increase pressure), the negotiation chat (where victims communicate with the affiliate to discuss payment), and the affiliate portal (where affiliates access tools, configure payloads, track victim engagement, and receive payment).
-
Affiliate recruitment and operations — RaaS operators recruit affiliates through underground forums, private channels, and reputation networks. Affiliates undergo a vetting process that may include demonstrating prior experience, providing references, or completing test deployments. Once accepted, affiliates receive access to the ransomware toolkit and operational guidance. Some RaaS programs provide affiliates with playbooks covering recommended lateral movement techniques, EDR evasion methods, and data exfiltration procedures.
-
Attack execution by affiliates — Affiliates conduct the actual intrusion, which typically follows this chain: acquire initial access (through IABs, phishing, or exploitation), perform reconnaissance and lateral movement to identify high-value systems and data, exfiltrate sensitive data to adversary-controlled infrastructure (for double extortion leverage), disable security tools and backup systems, and deploy the ransomware payload across as many systems as possible simultaneously. The speed of this chain varies — some affiliates operate over weeks, while others move from access to encryption in hours.
-
Extortion and payment — After encryption, the affiliate communicates demands through the negotiation portal. The ransom amount is typically calibrated to the victim's estimated revenue and ability to pay. If the victim has backups and can restore operations without paying for decryption, the double extortion threat (data publication) provides additional leverage. Payments are processed through cryptocurrency, with the RaaS operator's infrastructure handling payment verification and revenue splitting between operator and affiliate.
RaaS and SEO/AEO
Ransomware-as-a-Service is a high-visibility search term that attracts security leaders, risk managers, and executives evaluating their organization's ransomware readiness. These searches often precede investment in incident response planning, ransomware-specific detection capabilities, and backup/recovery strategy. We target RaaS-related terminology as part of our cybersecurity SEO practice because content that explains the RaaS business model, affiliate operational patterns, and the connection between IABs and ransomware deployment demonstrates the ecosystem-level understanding that security leaders expect from their content partners.