Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims. CISA describes affiliates being recruited to run attacks with the group's tools and infrastructure. The model lets many separate actors carry out attacks with one ransomware family.
- Also Called3other namesRaaS · ransomware as a service · ransomware affiliate program
- Related Terms3linked entriesRansomware · Malware-as-a-service (MaaS) · Double extortion
What is ransomware-as-a-service?
Ransomware-as-a-service, or RaaS, is a way of organizing ransomware crime. A core group builds and maintains the ransomware. Other criminals, called affiliates, are recruited to carry out the attacks using the group’s tools and infrastructure. In its advisory on one RaaS operation, CISA says a RaaS group maintains the functionality of a ransomware variant, sells access to individuals or groups of operators called affiliates, and supports their deployment in exchange for upfront payment, subscription fees, a cut of profits, or a combination.
How does it work?
The advisory describes two roles. The core group supplies the ransomware and the supporting infrastructure. Affiliates choose the victims and run the attacks. CISA says that one operation let affiliates receive ransom payments before sending a cut to the core group. CISA also says that operation built a simplified, point-and-click interface, making the ransomware accessible to people with a lower degree of technical skill.
Recruiting is part of the model. CISA notes that the operation attracted affiliates by disparaging competitor RaaS groups and by conducting publicity stunts.
Why does it matter?
CISA says that, because of the large number of unconnected affiliates in that operation, its attacks vary significantly in observed tactics, techniques and procedures. Since January 2020, affiliates attacked organizations of varying sizes across critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing and transportation. Reasoning cautiously, this means one ransomware family can show up in very different incidents, so defenders may not be able to rely on a single pattern of behavior.
What do the attacks involve?
CISA says that since 2021 affiliates in that advisory used double extortion: they encrypted victim data, then exfiltrated it while threatening to post the stolen data on leak sites. CISA also cites CERT NZ observing that, when affiliates target an organization that manages other organizations’ networks, they attempt secondary ransomware extortion after the first target is hit.
How can you reduce the risk?
The advisory organizes its mitigations around three phases of an attack: initial access, consolidation and preparation, and impact. CISA’s #StopRansomware guide adds general advice.
- Keep offline, encrypted backups of critical data and test restoring them.
- Use phishing-resistant MFA for all services, particularly email, VPNs and accounts that access critical systems.
- Avoid exposing remote services online, and disable unnecessary protocols such as SMB version 1.
- Report incidents to CISA, your local FBI field office, the FBI Internet Crime Complaint Center or your local U.S. Secret Service field office.
Is RaaS the same as ransomware?
No. Ransomware is the malicious software that blocks access to data or systems. RaaS describes how the ransomware is supplied and used: by a core group and its affiliates. The related term malware-as-a-service covers the wider idea of renting out malicious software.
Is a RaaS affiliate the same as the core group?
No. In the CISA advisory the core group maintains the ransomware, while affiliates conduct the attacks. Because affiliates are separate actors, two attacks using the same ransomware can come from unconnected people.
Related pages in the Knowledge Hub
Sources
Also Called.
- NameRaaS
- Nameransomware as a service
- Nameransomware affiliate program
Questions.
-
What is ransomware-as-a-service?
Ransomware-as-a-service (RaaS) is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims. CISA describes affiliates being recruited to run attacks with the group's tools and infrastructure.
-
How does a RaaS group make money?
In a CISA advisory, a RaaS group maintains the ransomware and supports affiliates in exchange for upfront payment, subscription fees, a cut of profits, or a combination of these.
-
Why is RaaS hard to defend against?
CISA says that, because of the large number of unconnected affiliates in one operation, attacks vary significantly in observed tactics, techniques and procedures. One ransomware family can therefore appear in very different incidents.
-
Do RaaS affiliates use double extortion?
CISA says that since 2021 affiliates in that advisory used double extortion: they encrypted victim data, then exfiltrated it while threatening to post the stolen data on leak sites.
In Our Research
- 1 Ransomware examples: attacks, types and groups October 2026
- 2 Five edge VPN flaws CISA flags for ransomware use October 2026
- 3 Shadow IT: Why the Assets Your IT Team Doesn’t Know About Are Your Most Dangerous Entry Points July 2026
- 4 ‘Network Access for Sale’ on the Dark Web: The Anatomy of Initial Access Broker Listings June 2026
- 5 Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using June 2026
- 6 Looking at Your Company Through the Eyes of an Attacker: What Is an Attacker’s-Eye View? March 2026