Ransomware-as-a-Service (RaaS) is a business model in which one group develops and runs the ransomware, and other criminals, called affiliates, use it to attack victims. The operator and the affiliate share the ransom. The model follows the same logic as malware-as-a-service.

How it works

• The operator provides a web portal where affiliates build their own ransomware versions with unique keys.
• Many programs include negotiation chat tools and access to a data leak site.
• Affiliates find their own way in, often by buying access from an initial access broker.
• The operator usually keeps a share of each payment, and the affiliate keeps the rest.

The UK NCSC describes RaaS as the ransomware business model seen most often. It stresses that it is typically the affiliate, not the RaaS group, that obtains and uses the access.

Why it matters for dark web monitoring

Because affiliates use many different entry points, attacks under one ransomware name can look very different. Defenders gain more by watching the supply side: stolen credentials, access sales and leak site posts. CISA’s #StopRansomware guidance recommends basics such as offline backups, patching and MFA, which interrupt most of these attacks regardless of the brand.

Sources: NCSC: Ransomware, extortion and the cyber crime ecosystem, CISA: #StopRansomware Guide