What is ransomware-as-a-service? A plain-English guide

Ransomware-as-a-service (RaaS) is a criminal business model where malware developers lease their ransomware code and infrastructure to other criminals, called affiliates, in exchange for a cut of any ransom paid. It industrialised extortion by removing the technical barrier to entry. A hospital, school, or small business can now be hit by an affiliate who has never written a line of code.

How does ransomware-as-a-service actually work?

A core developer team builds the ransomware and runs a support portal, much like a legitimate software company. Affiliates sign up, receive ready-made attack tools, and keep somewhere between 70 and 80 percent of each ransom, with the rest going to the developers.

The division of labour is deliberate. Developers stay insulated from the hands-on intrusions that attract law enforcement attention, while affiliates handle the breaking in, the file encryption (scrambling victims' data with a digital lock that only the gang's key can undo), and the extortion negotiation. CISA has documented this split-role structure across multiple RaaS groups.

Who are the main RaaS groups?

Several groups have been publicly named by law enforcement and government agencies. LockBit, which CISA identified as the world's most deployed ransomware variant as of early 2023, operated as a classic RaaS platform, advertising on criminal forums and offering affiliates a polished dashboard. BlackCat (also called ALPHV) ran a similar model and targeted critical infrastructure including hospitals. Hive, before a FBI takedown operation disrupted its infrastructure, had claimed more than 1,500 victims across healthcare, education, and finance.

These are not loose collectives. They maintain recruitment pipelines, affiliate vetting, and even customer service lines for victims to negotiate payment.

What does a RaaS attack look like from the victim's side?

The victim's experience is largely the same whether they face a lone programmer or a RaaS affiliate. Files become inaccessible, a ransom note appears on screen, and a deadline is set, often 72 hours, before the demanded price doubles or stolen data is published.

RaaS groups increasingly use double extortion: encrypting data and threatening to leak it publicly if payment is refused. Some have moved to triple extortion, adding threats to notify the victim's customers or regulators. CISA's ransomware guidance notes that data exfiltration before encryption is now standard practice among sophisticated groups.

Ransom demands vary by target size. Healthcare providers and manufacturers have faced demands from tens of thousands of dollars into the tens of millions.

Why is RaaS harder to stop than traditional ransomware?

Taking down a RaaS group does not eliminate the threat. Affiliates simply migrate to a competing platform, carrying their access credentials and techniques with them. Developers can rebrand under a new name within weeks.

The affiliate layer also complicates attribution. Law enforcement must untangle which actor performed the intrusion, which provided the tools, and which received the ransom, often across multiple jurisdictions with no mutual legal assistance treaties.

What are the warning signs a network is being prepared for a RaaS attack?

Affiliates typically spend days to weeks inside a network before triggering encryption, a period security teams call dwell time. Spotting the precursors matters more than reacting to the ransom note.

Warning sign	What it means in plain language
Credential-dumping tools (e.g. Mimikatz) detected	Attacker is harvesting passwords to move deeper into the network
Lateral movement to domain controllers	Attacker is seeking administrative control of all machines
Large outbound data transfers at odd hours	Exfiltration before encryption begins
Legitimate remote-access tools installed unexpectedly	Attacker is planting a persistent back door
Security software disabled or uninstalled	Preparation to run ransomware without triggering alerts

NIST's cybersecurity framework recommends continuous monitoring and anomaly detection as the primary controls against exactly this kind of pre-encryption behaviour.

Should victims pay the ransom?

Neither CISA nor the FBI recommends paying. Payment does not guarantee data recovery, does not prevent the attacker from selling stolen data anyway, and funds further criminal operations. CISA states explicitly that paying a ransom may also expose the victim to sanctions risk if the receiving group is on a government sanctions list.

That said, some organisations have paid, particularly where backups were also encrypted or where patient safety was at immediate risk. The decision carries legal, financial, and ethical weight that goes beyond the technical recovery question.

How can a small business reduce its exposure?

Offline backups, tested regularly, remain the single most effective recovery tool because they cannot be reached by ransomware running on the network. Multi-factor authentication (a second proof of identity beyond a password) closes the stolen-credential path that most RaaS affiliates rely on to gain initial access. CISA's cross-sector guidance lists both as top-priority controls.

Patching software promptly matters too. Several major RaaS campaigns have exploited known vulnerabilities with published CVE identifiers that had fixes available for months before victims were hit.

Common questions

Is ransomware-as-a-service illegal to use or to build?

Yes, on both counts. Deploying ransomware is a criminal offence under computer fraud and cybercrime laws in most jurisdictions, and developing or distributing it for others to use carries the same liability.

Can antivirus software stop a RaaS attack?

Antivirus can catch known ransomware variants, but RaaS developers update their code regularly to evade signature-based detection, so it is a useful layer but not a complete defence on its own.

Do RaaS groups really offer customer support?

Yes. Several groups, including LockBit and Hive, operated help-desk chat functions so victims could negotiate payment, verify that decryption keys worked, and arrange cryptocurrency transfers, mirroring legitimate software support in structure if not in purpose.