Ransomware-as-a-Service Explained: The Affiliate Model

Ransomware stopped being a lone hacker's tool years ago. It became a supply chain. The people who write the encryptor rarely break into anyone. The people who break in rarely write code. Between them sits a rented platform, a cut of every payment, and a support desk. This is ransomware-as-a-service, and it explains why the volume of attacks kept climbing even as any single crew got taken down.

Treating ransomware as a business, with roles and margins and marketing, is the clearest way to understand why it is hard to stop and where a defender actually has leverage.

What ransomware-as-a-service means

Ransomware-as-a-service, or RaaS, is a subscription or profit-sharing arrangement. An operator builds and maintains the ransomware: the encryptor, the control panel, the payment site, and the public leak site where victims get named. Affiliates rent access to all of that and use it to run their own intrusions. When a victim pays, the operator and the affiliate split the money.

The arrangement mirrors legitimate software-as-a-service, right down to onboarding guides, dashboards, and support channels. The operator competes for affiliates by offering a better encryptor, a bigger cut, or more reliable infrastructure. The affiliate competes for victims by being good at breaking in.

The division of labour

RaaS works because it splits a complex crime into specialised roles that can be filled independently.

Role	What they do	How they profit
Operator or developer	Builds and maintains the ransomware and leak site	Takes a percentage of each ransom
Affiliate	Breaks in, moves laterally, deploys the encryptor	Keeps the larger share of the ransom
Initial access broker	Sells ready-made footholds into networks	Paid per access, before any ransom
Negotiator and support	Runs the victim chat and pressure campaign	Salaried or cut of proceeds
Launderer	Moves and cashes out the cryptocurrency	Fee on the laundered amount

No single person needs every skill. An affiliate who cannot write malware rents it. An affiliate who cannot get in buys access from a broker. This is why the barrier to running a ransomware attack dropped so far, and why the population of attackers grew.

The brokers deserve special attention, because they decouple the break-in from the extortion. To see who supplies access and who buys it, our Threat Groups directory tracks the ransomware operations and the access brokers that feed them.

Double extortion changed the math

Early ransomware had one lever: encrypt the files and sell the decryption key. A victim with good backups could restore and refuse to pay. Attackers answered with double extortion.

In a double-extortion attack, the affiliate steals a copy of the data before encrypting anything. Now there are two threats. Pay, or you cannot decrypt your files. Pay, or we publish your data on the leak site. Backups solve the first problem and do nothing for the second. Some crews extend this to multi extortion, adding pressure such as contacting customers, partners, or regulators, or launching denial-of-service against the victim.

This is why the modern advice treats a ransomware incident as a data breach from the first hour. The encryption maps to Data Encrypted for Impact (T1486), but the exfiltration that happened first is the part that keeps costing you after the files are restored.

Restoring backups does not end a double-extortion incident

If data was stolen before encryption, clean backups get your operations back but do nothing about the copy the attacker holds. You still face a potential leak, regulatory duties, and notification obligations. Plan for the exfiltration, not only the outage, and involve legal and communications early.

Why chasing brand names fails

RaaS brands appear, get disrupted, and rebrand under new names constantly. Affiliates are not loyal; they work with whichever operation offers the best terms, and the same affiliate may deploy several different ransomware families over a year. Law enforcement takedowns remove infrastructure, and the people scatter and regroup.

For a defender, this means the specific family in the ransom note is nearly the least useful detail. The parts that stay constant are how affiliates get in and how they behave once inside. Those patterns repeat across brands, which is exactly why defending the technique pays off while tracking the brand does not.

The intrusion usually starts small

Despite the sophisticated economy behind it, a RaaS intrusion tends to begin unglamorously:

A valid credential, phished or bought from a stealer log, used against a remote-access service or VPN.
An exposed or vulnerable service reachable from the internet.
A purchased foothold from an access broker who already did the break-in.

From there the affiliate follows a familiar path: establish persistence, escalate privileges, move laterally, find and copy the valuable data, disable backups and security tools, then deploy the encryptor everywhere at once. The encryption is the final act. Everything valuable to the defender happens in the days before it, while the affiliate is still moving quietly.

How to detect and defend

Because encryption is the last step, the entire window before it is an opportunity to detect and contain. Priorities that match how RaaS actually operates:

Harden identity first. Most intrusions start with a credential. Enforce phishing-resistant multi-factor authentication on every remote-access path, retire legacy protocols that skip it, and monitor for impossible logins and new access from unusual locations.
Keep offline, tested backups. Follow a 3-2-1 approach and keep at least one copy offline or immutable so an affiliate who reaches your backups cannot delete them. Test restores, because an untested backup is a guess.
Segment the network. Flat networks let one foothold reach everything. Segmentation slows lateral movement and buys detection time.
Detect the pre-encryption stage. Hunt for the behaviour that precedes deployment: mass file access, backup deletion, security tools being disabled, and large outbound transfers that signal exfiltration. Catching any of these can stop the attack before encryption.
Watch for exfiltration. Because double extortion steals data first, unusual outbound volume to unfamiliar destinations is both a ransomware warning and a breach in its own right.
Reduce the attack surface. Patch internet-facing services promptly, remove exposed remote-access endpoints that do not need to be public, and close the exposures brokers sell.
Rehearse the response. Have an incident plan that treats ransomware as a data breach, with legal, communications, and decision-makers on it before you need them.

Watch for backup deletion and tool tampering

Two of the most reliable pre-encryption signals are attempts to delete or encrypt backups and attempts to disable endpoint protection. Alert on shadow-copy deletion, backup-service tampering, and security agents being stopped. These almost always precede deployment and give you a narrow window to isolate the affected hosts.

Ransomware-as-a-service is durable because it is a functioning market, with specialists, margins, and redundancy. You will not shut down the market. You can make yourself an unprofitable target by hardening the entry points affiliates rely on, keeping backups they cannot reach, and catching the intrusion in the quiet days before the ransom note. The economics only work when the break-in is cheap. Raise that cost and the affiliate moves on.

Walking through a RaaS intrusion, stage by stage

Seeing a full intrusion as an ordered sequence shows where a defender can still act, because encryption is the last step and everything before it is a window. The stages below describe how a typical affiliate operation unfolds after the platform has been rented.

It begins with initial access. The affiliate needs a way in, and the three common routes are a valid credential phished or bought from a stealer log, an exposed or vulnerable internet-facing service, or a ready-made foothold purchased from an access broker who already did the break-in. This stage often happens quietly and may not touch anything a victim monitors, which is why it so frequently goes unnoticed.

Next comes establishing a foothold and persistence. The affiliate makes sure they can return even if the original access is closed, installing a backdoor, creating an account, or abusing a remote-management tool that blends into normal administration. At this point the intrusion is small and reversible if caught.

Then the affiliate escalates privileges and performs discovery. They seek higher-privileged accounts, ideally domain-wide administrative control, and they map the environment: where the file servers are, where the backups live, which security tools are deployed, and what data is valuable. This reconnaissance is deliberate and often spans days, because the affiliate wants to understand the network before acting.

Lateral movement follows. Using the credentials and access gathered, the affiliate spreads to more machines, working toward the systems that hold the crown-jewel data and the backup infrastructure. A flat network makes this stage fast, and segmentation makes it slow and noisy.

The next stage is the one that changed the economics: data exfiltration. Before encrypting anything, the affiliate copies the valuable data out of the network to storage they control. This is the double-extortion setup, and it is the step that turns a ransomware event into a data breach regardless of whether the victim can restore from backups.

Then comes impact preparation. The affiliate disables or deletes backups, stops security tools, and clears logs, removing the victim's ability to recover and to see what is happening. Attempts to delete shadow copies, tamper with backup services, and kill endpoint agents cluster here, and they are among the most reliable warning signs.

Finally, deployment. The affiliate pushes the encryptor to as many machines as possible at once, often timed for a night or weekend to slow the response, and the ransom note appears. The encryption maps to MITRE ATT&CK Data Encrypted for Impact. This is the first stage most victims actually notice, and by then the damage of the earlier stages, especially the exfiltration, is already done.

The visible event is the last event

By the time the ransom note appears, the affiliate has usually been inside for days, has already stolen the data, and has already crippled the backups. The entire value of detection is in the earlier stages, when the intrusion is still small and the data has not yet left. A defense that only reacts to the encryption is reacting to the end of the story.

Detection signals across the intrusion

Because the encryption is the final act, the days before it are full of behaviour a defender can catch. The signals below map to the stages above, and any one of them deserves investigation.

New or unusual remote-access activity is an early signal. Logins to a VPN or remote-desktop service from an unfamiliar location, at an odd hour, or using an account that rarely connects remotely can mark the initial access stage. Impossible-travel logins, where one account authenticates from two distant places in a short time, are a classic indicator.

Signs of privilege escalation and discovery follow. Creation of new administrative accounts, sudden use of administrative tools by an account that does not normally run them, and bursts of internal reconnaissance such as scanning for file shares or querying directory services all point to an attacker mapping the environment.

Lateral movement leaves traces in authentication logs. The same account logging into many machines in quick succession, use of remote-execution tools to run commands on other hosts, and access to systems a user has no business touching are all worth alerting on.

Exfiltration shows up as outbound volume. Large transfers to unfamiliar external destinations, especially to cloud storage or file-transfer services the organisation does not use, signal that data is leaving. Because double extortion steals data first, this is both a ransomware warning and a breach indicator in its own right.

Impact preparation is the loudest signal and the last chance. Attempts to delete volume shadow copies, tampering with or stopping backup services, and endpoint protection agents being disabled across multiple machines almost always precede deployment. Alerting on these gives a narrow but real window to isolate hosts before the encryptor runs.

The economics that keep RaaS alive

Understanding the money explains why the model is resilient and where a defender actually has leverage. RaaS works because it distributes both the labour and the risk across specialists, and because each participant is paid in a way that keeps them in the market.

The operator earns a percentage of each successful ransom, so their incentive is to recruit capable affiliates and give them reliable tooling, a working leak site, and responsive support. The affiliate keeps the larger share of the ransom, which is their reward for the risky, skilled work of breaking in and moving through the network. The access broker is paid up front, per access, before any ransom is collected, which decouples their income from whether the extortion succeeds and gives them a steady business selling footholds. The negotiator and support staff are paid a salary or a cut for running the victim chat and applying pressure. The launderer takes a fee for moving and cashing out the cryptocurrency.

This structure has two consequences that matter to defenders. First, no single participant needs the full skill set, which is why the population of attackers grew: an affiliate who cannot write malware rents it, and one who cannot break in buys access. Second, the model is redundant. Take down one operator and the affiliates move to another, take down a broker and others fill the gap, because the roles are modular and the market rewards whoever fills them. You cannot defeat the market by removing one participant.

The leverage for a defender sits in the economics of the break-in. The affiliate's business only works when access is cheap and intrusions are quick. Every control that makes your organisation harder or slower to break into raises the affiliate's cost, and affiliates, being rational operators chasing margin, prefer easier targets. You do not have to make an attack impossible, you have to make your organisation a worse deal than the next one.

RaaS compared with other cybercrime models

RaaS is one instance of a broader shift toward crime delivered as a service, and placing it alongside its relatives clarifies what is distinctive about it.

Model	What is rented or sold	Buyer's role
Ransomware-as-a-service	The encryptor, leak site, and payment infrastructure	Affiliate breaks in and deploys, splits the ransom
Access-as-a-service	Ready-made footholds into breached networks	Buyer decides what to do with the access
Malware-as-a-service	A specific malware family, such as a loader or stealer	Buyer runs their own campaign with it
Phishing-as-a-service	Phishing kits, templates, and hosting	Buyer runs the phishing operation
Denial-of-service for hire	Access to a stress or botnet service	Buyer points the attack at a target

The pattern across all of these is specialisation and rental, which lowers the skill and capital needed to commit a given crime. RaaS is distinctive because it sits at the top of this stack and consumes the others: a RaaS affiliate often buys access from an access-as-a-service broker, may use malware-as-a-service tooling for parts of the intrusion, and may have reached the victim through a phishing-as-a-service campaign. RaaS is the assembly point where these services combine into a full extortion operation.

Common misconceptions about RaaS

Several assumptions lead defenders to prepare for the wrong thing.

Good backups make ransomware a non-event. Backups restore your operations, and they do nothing about data the affiliate stole before encrypting. Double extortion means a clean restore still leaves you facing a potential leak, regulatory duties, and notification obligations. Backups are necessary and not sufficient.

The specific ransomware family in the note is the key detail for defense. Affiliates rotate between families and operations rebrand constantly, so the family name is nearly the least durable fact about an incident. What stays constant is how affiliates get in and how they behave inside, and defending those patterns pays off while chasing brand names does not.

Paying the ransom makes the problem go away. Payment may yield a decryption key, and it carries no guarantee that the stolen data is deleted, that the decryptor works fully, or that the victim will not be targeted again. It also funds the market. Whether to pay is a serious legal and business decision, and it is not a clean exit.

Only large enterprises are targeted. Affiliates target whoever is profitable to breach, and small and mid-sized organisations are attractive precisely because they often have weaker controls and still enough revenue to pay. The low cost of entry that RaaS created widened the range of viable victims downward.

Ransomware is a sophisticated, novel-malware problem. The intrusion usually starts with something unglamorous: a stolen credential, an exposed service, or a purchased foothold. The sophistication is in the business model and the operation, and the entry point is often mundane, which is good news because mundane entry points are exactly what identity hardening and attack-surface reduction close.

How the model evolved

Ransomware began as an unsophisticated, high-volume nuisance. Early campaigns encrypted individual machines more or less at random, demanded small payments, and relied on victims lacking backups. The economics were thin, and a victim with a recent backup could simply restore and ignore the demand.

Two changes turned it into the industry it is now. The first was the shift to human-operated, targeted intrusions, where an attacker breaks in, takes control of the whole network, and deploys the encryptor everywhere at once for a single large ransom, rather than spraying it at individuals. That raised the payoff per victim dramatically and rewarded skill and patience. The second was the affiliate model itself, which split the now more complex crime into rentable specialties, so that operators who built good tooling could profit from affiliates' break-ins, and affiliates without development skills could still run attacks. Together these created a market with margins, competition, and reinvestment.

Double extortion was the next escalation, adding data theft before encryption so that backups alone no longer neutralised the threat. Some operations extended this to multi extortion, layering on pressure such as contacting the victim's customers, partners, or regulators, or launching denial-of-service against the victim to add urgency. Alongside these tactics came a supporting economy of initial access brokers who specialise in breaking in and selling footholds, which decoupled the intrusion from the extortion and fed affiliates a steady supply of targets. Each step made the model more resilient and the defensive priorities clearer: harden identity, keep backups the attacker cannot reach, segment the network, and detect the quiet pre-encryption stage where the damage is still preventable.

Frequently asked questions

What exactly is ransomware-as-a-service? It is a profit-sharing or subscription arrangement where an operator builds and maintains the ransomware, the payment site, and the leak site, and affiliates rent access to run their own intrusions. When a victim pays, the operator and affiliate split the money. It mirrors legitimate software-as-a-service, with onboarding, dashboards, and support, which is what made running ransomware accessible to attackers who could not build it themselves.

Why does double extortion matter so much? Double extortion steals a copy of the data before encrypting anything, so the victim faces two separate threats: they cannot decrypt their files, and their stolen data will be leaked. Backups solve the first and do nothing for the second. That is why modern guidance treats a ransomware incident as a data breach from the first hour, involving legal and communications early.

If I have good backups, am I safe from RaaS? Backups are essential and not sufficient. They restore your operations after encryption, and they do nothing about data the affiliate exfiltrated before encrypting. With double extortion you still face a potential leak and the regulatory and notification duties that come with a breach. Keep tested, offline or immutable backups, and also plan for the exfiltration.

Should we focus on the specific ransomware group that hit us? The specific family is one of the least durable details, because affiliates switch families and operations rebrand frequently. What stays constant is how affiliates gain access and behave inside a network, so defending those techniques generalises across groups. Track the brand for reporting and threat intelligence, and build your defenses around the intrusion patterns.

Where does a RaaS attack usually start? It usually begins unglamorously: a valid credential that was phished or bought from a stealer log, an exposed or vulnerable internet-facing service, or a foothold purchased from an access broker who already broke in. Novel malware is rarely the entry point, which is why identity hardening and attack-surface reduction close so many intrusions before they start.

What is the single most valuable detection opportunity? The pre-encryption stage, especially attempts to delete or encrypt backups and to disable security tools. These almost always precede deployment and give a narrow window to isolate affected hosts before the encryptor runs. Watching for large outbound transfers also catches the exfiltration that double extortion depends on.

Does paying the ransom resolve the incident? Not cleanly. Payment may produce a decryption key, and it does not guarantee the decryptor works fully, that the stolen data is deleted, or that you will not be hit again, and it funds the criminal market. It is a significant legal and business decision with real risk on both sides, and it should be made with legal counsel rather than treated as a simple fix.