What is ransomware as a service (RaaS)?

Ransomware as a service is a business model in which developers lease their ransomware to affiliates, who carry out the attacks and split the proceeds with them. The developers provide the encryption software, a control panel, a leak site for publishing stolen data, payment handling and sometimes negotiators and support. The affiliates bring access to victims, often bought from initial access brokers, and do the intrusion work. The model explains several things small companies notice: ransomware is no longer limited to skilled attackers, attacks are frequent and opportunistic rather than aimed only at famous names, and the same brand can appear with very different techniques. Most families in recent CISA and FBI advisories, including LockBit, ALPHV, RansomHub and Medusa, are described as operating this way. Taking down the developers disrupts many affiliates at once, which is why law enforcement often goes after the platform.

← All 25 questions on Ransomware groups and familiesAll topics