Cybersecurity

What Is Ransomware as a Service?

Ransomware as a service, or RaaS, is the business model that turned ransomware from a specialist crime into a mass-market one. Experienced developers build the ransomware and rent it out to less skilled criminals — called affiliates — who carry out the attacks and share the profits. This guide explains how it works, why it made attacks so much more common, and what it means for defence.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Note. Ransomware as a service is a division of labour: developers build the tools, affiliates find the victims, and both take a cut. Understanding that split explains why attacks have become more frequent, more varied, and harder to stop with a single technical fix.

The basic idea

Think of ransomware as a service like a franchise. A core team of developers builds and maintains the ransomware — the encryption software, the payment portal, the leak site, the negotiation chat — and then rents access to other criminals. The renters, called affiliates, do the attacking: they find victims, break in, steal data, deploy the ransomware, and negotiate the ransom. The profits are split, commonly with the affiliate keeping the larger share and the developers taking a percentage.

This is why ransomware attacks surged. Before RaaS, launching a ransomware attack needed serious technical skill: you had to build the encryption software, set up a payment system, and run a leak site. RaaS removed that barrier. Anyone who can run a phishing campaign or buy stolen credentials can now rent an industrial-grade ransomware kit and launch an attack the same week.

The model also professionalised the crime. Developers compete on features — better encryption, faster deployment, friendlier negotiation tools — and recruit affiliates on criminal forums, sometimes with interviews and performance targets. Some operations have even been described as running like a software company, with support staff, documentation and release notes.

The roles inside a RaaS operation

The developers, sometimes called operators, own the brand and the platform. They write the ransomware, maintain the infrastructure, run the leak site, and handle the cryptocurrency wallets. They rarely carry out attacks themselves — their job is the platform, and they earn a percentage of every ransom.

Affiliates are the attackers. They are often less skilled, and they specialise in the early stages: phishing campaigns, buying access from initial access brokers, exploiting unpatched systems, and moving through a victim's network. An affiliate may work for several RaaS groups at once, choosing whichever kit suits a particular victim. Some affiliates are individuals; some are small teams.

Around these two roles sit supporting businesses. Initial access brokers sell entry into already-compromised networks — a username and password, a remote-access session — so an affiliate can skip the break-in entirely. Money laundering services turn the cryptocurrency ransom into usable funds. Negotiators, sometimes hired by the victim's insurer, handle the ransom conversation. Each piece is a service you can buy.

How an affiliate attacks, step by step

The attack usually starts with access: a phishing email with a malicious attachment, a stolen password purchased from a broker, or an unpatched internet-facing system. Once inside, the affiliate explores — finding the valuable data, the backups, the domain controllers — and copies the data out. This quiet phase can last days or weeks, and it is the best moment for a defender to catch the attack.

Next, the affiliate deploys the RaaS kit: the encryption runs, the ransom note appears, and the leak site timer starts. Negotiation happens through the platform's chat system, often with a support agent on the criminal side who will negotiate the amount and provide proof that the stolen data exists. If the victim pays, the platform releases a decryption tool — sometimes it works, sometimes it does not, and sometimes the victim is asked for more.

If the victim does not pay, the data is published on the leak site, or sold, or both. The affiliate moves on to the next target. The developers keep improving the kit. The cycle repeats — which is why the same ransomware brand can appear in attacks on hospitals, schools and small businesses in the same week, carried out by entirely different people.

Why RaaS made ransomware harder to stop

RaaS multiplies the number of attackers. Instead of a handful of skilled groups, there are now dozens of brands and hundreds of affiliates, each with different tactics and different targets. Stopping one group does not stop the others, and shutting down a brand often means its affiliates simply move to a rival kit.

It also makes attacks less predictable. One affiliate might target hospitals with phishing; another might buy access from a broker and target manufacturers; a third might exploit a single unpatched system. The same ransomware kit can be used in very different ways, so defenders cannot rely on recognising one attack pattern.

Finally, it lowers the skill floor. A person who could never write encryption software can still launch a devastating attack by renting the kit and following the instructions. That is the core problem RaaS created, and the reason the volume of attacks rose so sharply as the model spread.

What defence looks like against RaaS

The good news is that RaaS attacks still use the same entry points as all ransomware: phishing, stolen credentials, and unpatched systems. Multi-factor authentication, prompt patching, phishing training and the removal of unused remote-access services close most of those doors. Because affiliates often buy access from brokers, those credentials usually come from an earlier breach — which is why unique passwords and monitoring for leaked credentials matter.

Detection is the second layer: the quiet exploration phase is the affiliate's weak point. Alerts for odd-hour logins, large data transfers, new administrator accounts and disabled security tools can catch an attack before the encryption begins. Even simple measures — an alert when a large amount of data leaves the network, or when a new account is created — are powerful.

And the third layer is the same as ever: offline backups that are tested, and a written incident plan that is practised. RaaS means you may be attacked by someone who knows your industry and has a professional kit. It does not mean you are defenceless — the defences are ordinary, and they work.

RaaS multiplies attackers but not entry points — close the same doors.
Multi-factor authentication and patching defeat most affiliates.
Watch the quiet phase: odd logins, data transfers, new accounts.
Offline, tested backups and a practised incident plan.
Unique passwords: bought credentials usually come from an old breach.

Sources

CISA — Ransomware guidance — last checked 14 November 2026.
National Cyber Security Centre (UK) — Ransomware guidance — last checked 14 November 2026.
FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.