# What is ransomware as a service (RaaS)?

Ransomware as a service is a business model in which developers lease their ransomware to affiliates, who carry out the attacks and split the proceeds with them. The developers provide the encryption software, a control panel, a leak site for publishing stolen data, payment handling and sometimes negotiators and support. The affiliates bring access to victims, often bought from initial access brokers, and do the intrusion work. The model explains several things small companies notice: ransomware is no longer limited to skilled attackers, attacks are frequent and opportunistic rather than aimed only at famous names, and the same brand can appear with very different techniques. Most families in recent CISA and FBI advisories, including LockBit, ALPHV, RansomHub and Medusa, are described as operating this way. Taking down the developers disrupts many affiliates at once, which is why law enforcement often goes after the platform.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-ransomware-as-a-service

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is double extortion in ransomware?](https://netsenx.com/en/faq/what-is-double-extortion-ransomware)
- [What is a ransomware leak site?](https://netsenx.com/en/faq/what-is-a-ransomware-leak-site)
- [Where can we find official information about ransomware groups?](https://netsenx.com/en/faq/where-to-find-official-ransomware-advisories)
- [What is No More Ransom, and can it decrypt our files?](https://netsenx.com/en/faq/what-is-no-more-ransom)
- [What does a police takedown of a ransomware group mean for victims?](https://netsenx.com/en/faq/what-does-a-ransomware-takedown-mean-for-victims)