What Is Ransomware-as-a-Service (RaaS)?

Ransomware-as-a-Service (RaaS) is a criminal business model in which skilled ransomware developers rent their malware, infrastructure, and tooling to less-technical attackers, called affiliates, in exchange for a cut of the ransom. It works exactly like a software subscription business — complete with dashboards, support, documentation, and "customer service" — except the product encrypts your files and steals your data. RaaS is the reason ransomware exploded: it removed the skill barrier and turned attacks into a scalable, repeatable industry.

The RaaS operator builds and maintains the ransomware; affiliates do the breaking-in. Operators recruit affiliates, provide the encryptor, run the leak site and negotiation portal, and take a percentage of each payment — often around 20-30% — leaving the rest to the affiliate. This division of labor means a single ransomware strain can be deployed by dozens of independent crews against thousands of targets at once.

A whole supporting market feeds RaaS: Initial Access Brokers (IABs) specialize in breaching companies — via phishing, stolen credentials, or unpatched VPNs and remote services — and then sell that ready-made access to ransomware affiliates. An affiliate can essentially buy a foothold into your network and skip straight to deployment. This supply chain is why "we're too small to be a target" is a dangerous assumption.

Modern RaaS crews do not just encrypt — they exfiltrate your data first, then threaten to publish it on a leak site if you do not pay. That is double extortion, and it means backups alone no longer save you from the data-exposure threat. Some crews add a third layer: harassing your customers, partners, or even contacting regulators to increase pressure. Paying for a decryptor does not undo the theft.

RaaS affiliates increasingly avoid obvious malware by abusing legitimate, already-installed tools — PowerShell, PsExec, remote management software, and built-in admin utilities — to move through your network. These "living-off-the-land" techniques look like normal admin activity, which is precisely why detection-based tools like EDR miss a meaningful share of real attacks. The malware that finally encrypts is often a brand-new variant no signature recognizes.

Against an industrialized threat that constantly produces novel variants and abuses trusted tools, trying to recognize every bad thing is a losing game. A default-deny posture flips the model: only explicitly approved applications run, and even approved tools are ringfenced so they cannot perform ransomware behavior. The encryptor never executes because it was never on the allowlist — no signature required.