Ransomware-as-a-service (RaaS)
Also known as: RaaS, ransomware as a service, ransomware affiliate model
Ransomware-as-a-service (RaaS) is a criminal business model in which a ransomware group develops the malware, payment portals, and leak sites, then lets 'affiliates' use them to attack victims in exchange for a cut of each ransom.
The model works like a franchise, letting less skilled criminals launch damaging attacks. While law enforcement has disrupted major RaaS groups, the affiliates and code often resurface under new names.
Ransomware-as-a-service (RaaS), explained at three levels
At home
Ransomware-as-a-service works like a restaurant franchise. One criminal group builds the recipe: the ransomware, the payment website, and the support staff. Other criminals, called affiliates, pay to use it, break into victims' computers, and lock up their files. When a victim pays, the money is split between the affiliate and the group that built the kit, much like franchise fees.
At work
Ransomware-as-a-service is a criminal business model where one group develops ransomware and the tools to collect payments, then rents them to affiliates who carry out the break-ins and share each ransom. Because the hard technical work is done for them, many less skilled criminals can launch professional attacks. For businesses, that means even small organizations face well-equipped attackers.
At home
RaaS splits the crime into two jobs. The core group builds the encryption software, runs the payment and negotiation websites, and maintains a leak site. Affiliates rent that toolkit and do the break-ins, often using stolen passwords or unpatched systems. Once inside, they steal data, then encrypt files. The victim is told to pay or see the data published. When a ransom is paid, the money is split between the affiliate and the core group.
At work
Affiliates commonly keep about 70 to 80 percent of each ransom, and the core group provides builders, decryptors, negotiators and leak sites. Many affiliates buy entry from initial access brokers, who sell working VPN, remote desktop or stolen-session logins. Double extortion, encrypting and threatening to leak, is now standard, and some groups skip encryption entirely. Because affiliates move between brands when a group is disrupted, the same people and techniques often reappear under new names, as researchers saw when former Conti members turned up in groups such as Black Basta and Akira.
At home
Paying a ransom buys a promise from criminals and nothing more. Decryptors are often slow or buggy, stolen data may be leaked or sold anyway, and payers are frequently targeted again. Offline or immutable backups break the attack's leverage, because you can restore without negotiating. In my view, a backup that ransomware cannot reach is the best answer to any ransom note, whether you run a household or a business.
At work
Effective defence targets the affiliate playbook: MFA on all remote access, fast patching of internet-facing appliances, EDR with tamper protection, privileged access management, segmentation that slows lateral movement, and immutable, tested backups with a separate identity domain. Exfiltration detection matters because double extortion succeeds even when restores work. Plan legal steps in advance, including breach notification under PIPEDA, contacting the Canadian Centre for Cyber Security and police, and sanctions screening, since paying a sanctioned group can carry its own legal risk.
Real-world examples
At home
Sophie's dental clinic in Halifax was hit by ransomware. The attack used a well-known RaaS strain, and the clinic restored systems from offline backups instead of paying.
At work
Marcus is IT director at a Manitoba manufacturer. After learning that RaaS affiliates commonly break in through exposed remote desktop, he removed it from the internet and required VPN access with MFA.
How it compares
| feature | Ransomware-as-a-service (RaaS) | Traditional ransomware |
|---|---|---|
| Who builds the ransomware | A core developer group | The attacker |
| Who attacks | Many affiliates | Same group |
| Skill needed to attack | Lower | Higher |
| Scale | Very high | Limited |
RaaS franchises ransomware, multiplying the number of attackers.
For analysts
I'd assume ransomware will be attempted and test recovery, not just prevention. Restoring from clean backups within a defined time is what keeps a business alive.
History & origin
Early ransomware such as CryptoLocker in 2013 was run by single groups. Affiliate models spread in the late 2010s, with GandCrab, REvil, and later Conti, DarkSide, and LockBit becoming notorious. DarkSide's affiliate attack on Colonial Pipeline in May 2021 caused fuel shortages across the US East Coast. LockBit became one of the most prolific groups; Mikhail Vasiliev, a LockBit affiliate living in Bradford, Ontario, was arrested in 2022 and sentenced in Canada in 2024 before being extradited to the US. In February 2024, an international operation called Cronos, led by the UK's National Crime Agency, seized LockBit's infrastructure. Double extortion, stealing data before encrypting it and threatening to leak it, became standard. In my view, RaaS turned ransomware from a crime into an industry, complete with customer support and recruitment ads.