Ransomware-as-a-Service Explained: How Affiliates Rent Attack Kits and Split the Profits

The person who encrypts your servers probably never broke into them. That arrangement is now normal in large ransomware incidents. One group writes the malware, runs the leak site and hosts the negotiation portal. Someone else does the intrusion, often after buying a ready-made foothold from a third party. When a ransom is paid, the money is divided according to an agreement that no lawyer ever reviewed.

This is Ransomware-as-a-Service, or RaaS: a franchise model for digital extortion. Knowing how the pieces fit together explains why takedowns rarely end the problem, why the same malware appears across unrelated victims, and which defences genuinely reduce your exposure.

The Franchise Model Behind the Payload

An old-fashioned ransomware crew did everything itself: write code, phish, move laterally, negotiate, launder the proceeds. That model is fragile. Skills rarely sit in one room, and a single weak link can pull the whole operation apart. RaaS splits the work into separate businesses that can each be swapped out when they fail.

The core group — sometimes called the operator or developer — maintains the encryptor and everything around it: a web panel where affiliates build a custom payload, chat support, stolen-data hosting, a leak site with countdown clocks, and a portal for handling payment. In return, they take a percentage and set the rules. Many programmes publish a list of forbidden targets, such as hospitals or organisations in certain countries. Those bans exist less out of ethics than out of self-interest: an attack that provokes a serious law enforcement response hurts every affiliate using the brand.

Who Does What Inside a Crew

Depending on the programme, you may find some or all of these roles:

• Operators. Build and update the ransomware, run the affiliate panel, manage infrastructure, and decide who receives access to the build.
• Affiliates. The intruders. They obtain access, escalate privileges, steal data, deploy the payload at a moment of their choosing, and handle the victim's negotiation chat.
• Initial access brokers (IABs). Specialists who find and sell a way in: a valid VPN login, a web shell on an unpatched server, an exposed remote desktop service, a session cookie. Some sell exclusive access to one buyer; others resell the same foothold.
• Negotiators. People who join the chat posing as a helpful "support" contact, pressure the victim with deadlines, and test how much the organisation will pay.
• Cash-out networks. Intermediaries who move cryptocurrency, take a fee, and return usable funds to the affiliate. They often operate in jurisdictions where tracing is slow.
• Brokers and recruiters. Forum figures who vouch for newcomers, mediate disputes, and match affiliates with access sellers.

How the Money Is Split

Public reporting on several major crews has described revenue splits that favour the affiliate — frequently somewhere between 70 and 90 percent of the ransom, with the remainder going to the operator who supplied the tools. The logic is simple: the intrusion is the hard, risky part, and a programme that pays badly loses its affiliates to a competitor within weeks.

Paying for the door

Access brokers are usually paid a flat fee or a share of whatever ransom follows. Prices track the victim: a foothold inside a company with high revenue, weak backups and cyber insurance attracts far more interest than a small business with a single file server. Some brokers grade access by how quietly it can be used and how long it will survive.

Because the parties rarely trust each other, these deals run on reputation. Forums use escrow accounts, and programmes keep internal walls of shame for affiliates who hide payments or leak builds. When an operator disappears with the money, affiliates simply move to the next brand — the tradecraft travels with them.

From Stolen Credential to Encrypted Files

The typical chain looks like this, though it varies by target:

1. Reconnaissance: scanning for exposed services, reading job ads and supplier pages to map a target's technology.
2. A broker acquires and validates access, confirming the credentials still work and noting what privileges come with them.
3. Access is advertised or sold directly, sometimes with screenshots as proof.
4. An affiliate buys in, escalates to administrator rights, and maps the network over days or weeks.
5. Data is copied out first — customer records, finance files, anything embarrassing — before any encryption happens.
6. Backups are located and destroyed where possible, then the encryptor is deployed, often overnight or before a holiday.
7. Extortion begins: decrypt for money, stay silent for more, and increasingly a third threat such as calling clients or filing complaints with regulators.

Takedowns remove a brand, not a skill set.

Why RaaS Makes Attacks Harder to Trace

Every stage in that chain can involve a different person, in a different country, using infrastructure rented for a few days. The encryptor itself is a commodity: builders have leaked and been reused by dozens of unrelated crews, so finding one group's file on a victim's server proves very little. Investigators chasing a single culprit are often actually looking at three or four businesses that barely know each other's real identities.

That compartmentalisation also blunts disruption. When authorities seize an operator's servers or arrest its leadership, affiliates keep the credentials, the exfiltration tools and the contacts. They rebrand and continue. This is why news of a taken-down ransomware group is usually followed, months later, by familiar attacks under an unfamiliar name.

What Actually Reduces Your Risk

You cannot arrest your way out of this, but you can make yourself a poor business decision for an affiliate shopping for access. The following measures address the exact points where these operations break.

• Close the front door. No remote desktop exposed to the internet, multi-factor authentication on VPNs, webmail and admin consoles, and patches applied to internet-facing systems quickly.
• Kill unused accounts and excess privilege. Dormant service accounts and shared administrator logins are what brokers sell as "easy access".
• Make backups useless to an attacker. Keep at least one copy offline or immutable, and test a restore on real hardware rather than trusting a green tick in a dashboard.
• Watch for theft, not just encryption. Large outbound transfers and archive tools running at odd hours are often the earliest warning you get.
• Rehearse the bad day. Decide in advance who calls legal counsel, the insurer, law enforcement and key customers. A tabletop exercise costs a morning and saves days.
• Keep logs long enough to matter. If your retention window is a week, you may lose the evidence of how the intruders got in.

If a demand does arrive, treat it as a legal and business decision rather than a technical one. Contact your cyber insurer and legal counsel before replying, preserve evidence, and be aware that paying funds the model and offers no guarantee that stolen data stays private. Segmented networks, disciplined identity management and recoverable backups will not stop every affiliate, but they decide whether an intrusion becomes an inconvenience or an extinction event.

Photo: fancycrave1 / Pixabay