Ransomware-as-a-service is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims. CISA describes affiliates being recruited to run attacks with the group's tools and infrastructure. The model lets many separate actors carry out attacks with one ransomware family.
- Also Called3other namesRaaS · ransomware as a service · ransomware affiliate program
- Related Terms3linked entriesRansomware · Malware-as-a-service (MaaS) · Double extortion
What Is Ransomware-as-a-Service?
Ransomware-as-a-service, or RaaS, is a way of organizing ransomware crime. A core group builds and maintains the ransomware. Other criminals, called affiliates, are recruited to carry out the attacks using the group’s tools and infrastructure. In its advisory on one RaaS operation, CISA describes the model. The group maintains a ransomware variant and sells access to operators called affiliates. It supports their attacks in exchange for upfront payment, subscription fees, a cut of profits, or a mix.
Who Does What in a RaaS Group?
The advisory describes two roles. The core group supplies the ransomware and the supporting infrastructure. Affiliates choose the victims and run the attacks. CISA says that one operation let affiliates receive ransom payments before sending a cut to the core group. CISA also says that operation built a simplified, point-and-click interface, making the ransomware accessible to people with a lower degree of technical skill.
Recruiting is part of the model. For how the model grew, read how ransomware-as-a-service grew. CISA notes that the operation attracted affiliates by disparaging competitor RaaS groups and by conducting publicity stunts.
How Does a RaaS Attack Unfold?
CISA’s LockBit advisory shows the stages of one RaaS operation.
- Core group builds the ransomwareIt maintains the code, the control panel and the infrastructure.
- Affiliates are recruitedThey pay upfront, pay a subscription, share profit, or a mix of these.
- An affiliate breaks inCISA lists phishing, exposed RDP, internet-facing flaws and stolen accounts.
- Data is encrypted and stolenAffiliates also threaten to post the stolen data on leak sites.Technique T1486 (MITRE ATT&CK, opens in a new tab)
- The ransom is splitIn this operation affiliates collected payment first, then sent the core group its cut.
Each affiliate chooses its own way in, so the third step differs from case to case.
Why Do RaaS Attacks Look So Different?
CISA says that, because of the large number of unconnected affiliates in that operation, its attacks vary significantly in observed tactics, techniques and procedures. Since January 2020, affiliates attacked organizations of varying sizes across critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing and transportation. As a result, one ransomware family can show up in very different incidents. Defenders may not be able to rely on a single pattern of behavior.
How Do RaaS Affiliates Use Double Extortion?
CISA says that since 2021 affiliates in that advisory used double extortion: they encrypted victim data, then exfiltrated it while threatening to post the stolen data on leak sites. This is the pattern behind double extortion. CISA also cites CERT NZ observing that, when affiliates target an organization that manages other organizations’ networks, they attempt secondary ransomware extortion after the first target is hit.
What Cuts the Risk From RaaS Attacks?
The advisory organizes its mitigations around three phases of an attack: initial access, consolidation and preparation, and impact. CISA’s #StopRansomware guide adds general advice.
- Keep offline, encrypted backups of critical data and test restoring them.
- Use phishing-resistant MFA for all services, particularly email, VPNs and accounts that access critical systems.
- Avoid exposing remote services online, and disable unnecessary protocols such as SMB version 1.
- Report incidents to CISA, your local FBI field office, the FBI Internet Crime Complaint Center or your local U.S. Secret Service field office.
Is RaaS the Same as Ransomware?
No. Ransomware is the malicious software that blocks access to data or systems. RaaS describes how the ransomware is supplied and used: by a core group and its affiliates. The related term malware-as-a-service covers the wider idea of renting out malicious software.
Is a RaaS Affiliate the Same as the Core Group?
No. In the CISA advisory the core group maintains the ransomware, while affiliates conduct the attacks. Because affiliates are separate actors, two attacks using the same ransomware can come from unconnected people. Researchers have also documented a RaaS affiliate using an AI coding agent during intrusions. A RaaS administrator used AI to write code, as covered in AI tools that ransomware crews use.
Related Pages in the Knowledge Hub
Sources
- CISA: LockBit RaaS: affiliates recruited to use the group's tools and infrastructure; payment arrangements; point-and-click interface; double and secondary extortion.
- CISA: Report incidents to CISA, FBI field office or IC3; double extortion described.
- MITRE ATT&CK: T1486 Data Encrypted for Impact.
Also Called.
- NameRaaS
- Nameransomware as a service
- Nameransomware affiliate program
Questions.
-
What is ransomware-as-a-service?
Ransomware-as-a-service (RaaS) is a business model in which a core group maintains ransomware and lets other criminals, called affiliates, use it to attack victims. CISA describes affiliates being recruited to run attacks with the group's tools and infrastructure.
-
How does a RaaS group make money?
In a CISA advisory, a RaaS group maintains the ransomware and supports affiliates in exchange for upfront payment, subscription fees, a cut of profits, or a combination of these.
-
Why is RaaS hard to defend against?
CISA says that, because of the large number of unconnected affiliates in one operation, attacks vary significantly in observed tactics, techniques and procedures. One ransomware family can therefore appear in very different incidents.
-
Do RaaS affiliates use double extortion?
CISA says that since 2021 affiliates in that advisory used double extortion: they encrypted victim data, then exfiltrated it while threatening to post the stolen data on leak sites.
In Our Research
- 1 Ransomware in September 2026: 857 Victims Across 82 Groups, and What October Added October 2026
- 2 Ransomware examples: attacks, types and groups October 2026
- 3 Five edge VPN flaws CISA flags for ransomware use October 2026
- 4 Shadow IT: Why the Assets Your IT Team Doesn’t Know About Are Your Most Dangerous Entry Points July 2026
- 5 ‘Network Access for Sale’ on the Dark Web: The Anatomy of Initial Access Broker Listings June 2026
- 6 Vulnerability Exploitation Trends: H1 2026: What Threat Actors Are Actually Using June 2026