A decade ago, launching a sophisticated ransomware attack required technical expertise that was genuinely difficult to acquire. Writing the malware, building the command-and-control infrastructure, managing encryption key distribution, and handling victim negotiation were all capabilities that limited ransomware operations to a relatively small number of technically sophisticated actors.
That barrier no longer exists.
Ransomware as a Service has industrialized cybercrime in the same way that software as a service industrialized legitimate software delivery. The technical complexity of operating a ransomware attack has been abstracted away into a platform that affiliates access for a percentage of the ransom revenue. The person launching the attack no longer needs to understand how the malware works. They need only identify targets, deliver the payload, and wait for the platform to handle encryption, key management, victim communication, and payment processing.
The consequence of this industrialization is not just more ransomware attacks. It is a fundamentally different threat landscape where the sophistication of the attacker is no longer a reliable predictor of the sophistication of the attack. Organizations that sized their defenses against the small number of technically sophisticated actors that ransomware once required are now facing a much larger pool of operators using professional-grade tools.
This article covers how RaaS works, who operates and uses it, what it has done to the ransomware threat landscape, and what organizations need to understand about their defenses in light of it.
How Ransomware as a Service Works
The RaaS model mirrors legitimate software as a service in its structure while inverting its purpose. A core development team, the ransomware group, builds and maintains the ransomware platform. Affiliates, the operators who conduct the actual attacks, access the platform to deploy ransomware against targets they identify and compromise. The revenue from successful attacks is split between the affiliate and the core group according to a predefined arrangement, typically with the affiliate retaining 70 to 80 percent of collected ransoms.
The Core Group
The core group is responsible for the technical infrastructure of the ransomware operation. Their responsibilities include developing and maintaining the ransomware code, managing encryption and key generation infrastructure, operating the victim negotiation portal where infected organizations communicate with the attacker, maintaining the payment processing infrastructure for cryptocurrency transactions, operating the data leak site where exfiltrated data is published for victims who do not pay, and providing affiliate support including technical assistance and negotiation guidance.
The sophistication of the core group determines the technical quality of the ransomware platform. Major RaaS operations including LockBit, BlackCat, Cl0p, and their successors maintain development teams that release regular updates to their ransomware code, add features like cross-platform encryption capability and speed optimization, and respond to security researcher analysis that identifies weaknesses in their implementation.
The core group recruits affiliates through dark web forums and private channels, screening for operational security practices and excluding affiliates who are known to attract excessive law enforcement attention or who have a history of unreliable payment sharing.
The Affiliates
Affiliates are the operators who conduct the actual intrusions. They are responsible for identifying targets, gaining initial access, conducting the dwell period reconnaissance and exfiltration, and deploying the ransomware payload at the time of their choosing. The affiliate does not need to understand the technical details of the ransomware platform. They interact with a dashboard that provides access to the ransomware builder, victim management tools, and negotiation status.
The affiliate pool in major RaaS operations is diverse. It includes technically sophisticated penetration testers who apply their skills to criminal operations, initial access brokers who purchase pre-compromised network access from other specialists and then deploy ransomware, organized criminal groups with existing criminal infrastructure that adds ransomware as a revenue stream, and in some documented cases former legitimate cybersecurity professionals who chose criminal application of their skills.
What the affiliates share is not technical sophistication but criminal motivation and access to the RaaS platform that provides the technical sophistication they do not need to possess themselves.
The Initial Access Broker Ecosystem
The specialization within the RaaS ecosystem extends beyond the core group and affiliate structure. Initial access brokers are specialists who compromise organizational networks and then sell that access on criminal markets rather than deploying ransomware themselves. RaaS affiliates purchase this pre-compromised access, combining their ransomware deployment capability with the access broker’s intrusion expertise.
This specialization further lowers the effective barrier to sophisticated ransomware attacks. An affiliate who is skilled at ransomware deployment but not at network intrusion purchases the intrusion from a specialist and deploys their platform against the pre-compromised environment. The result is an attack that combines specialist expertise at both the intrusion and deployment layers without requiring any single actor to master both.
Initial access broker listings on criminal markets include detailed descriptions of the compromised environment: the organization’s industry, revenue, number of employees, the systems accessible through the compromised access, and the security tools present in the environment. This information enables affiliates to evaluate targets before purchase and to price access according to the value it provides.
What RaaS Has Done to the Threat Landscape
The industrialization of ransomware through the RaaS model has changed the threat landscape in ways that make simplistic assessments of organizational vulnerability obsolete.
Volume Has Increased Dramatically
The most visible consequence of RaaS is the volume of ransomware attacks. When attacking organizations required building ransomware from scratch, the number of active ransomware operators was constrained by the scarcity of that expertise. When attacking organizations requires only affiliate registration with an established RaaS platform, the number of potential operators is constrained only by criminal motivation and the ability to gain initial access.
The result is a threat landscape where organizations across every industry and size tier are targeted, not just organizations that present profiles attractive to sophisticated actors. Small and mid-size organizations are targeted because they present lower barriers to initial access and lower likelihood of sophisticated detection and response, making them efficient revenue opportunities for affiliates operating on volume.
The Quality Floor Has Risen
The counterintuitive effect of RaaS on attack sophistication is that the floor has risen even as the technical requirement for individual operators has fallen. Affiliates using LockBit or BlackCat are deploying ransomware developed and maintained by sophisticated technical teams who have invested significant resources in evading detection, maximizing encryption speed, and optimizing for ransom collection.
An organization attacked by a low-sophistication affiliate using a high-sophistication platform faces technical ransomware capability that exceeds what many organizations have sized their defenses to address. The affiliate’s low technical sophistication does not reduce the sophistication of the encryption, the speed of lateral movement, or the effectiveness of backup targeting, because those capabilities are provided by the platform rather than the operator.
Targeting Has Become More Systematic
The initial access broker ecosystem has introduced systematic targeting intelligence into the ransomware attack chain. Access listings include specific information about the target organization’s security tools, network size, and revenue, enabling affiliates to select targets based on expected ransom value relative to detection and response capability.
Organizations in industries with known regulatory payment pressure, including healthcare, financial services, and defense contracting, command higher access prices on criminal markets because the operational pressure those regulatory consequences create increases the probability of ransom payment. Organizations with visible security tool gaps, identified through the initial access broker’s reconnaissance, are valued higher because the probability of successful encryption and ransom collection is greater.
This systematic targeting means that organizational vulnerability is not random. It is assessed and priced before the attack begins, and organizations that present the combination of valuable data, regulatory payment pressure, and security gaps are prioritized in the affiliate’s target selection.
Geographic and Sector Restrictions Have Emerged
Major RaaS operations have established affiliate rules about which targets are permissible. Many operations prohibit attacks on hospitals, schools, and government infrastructure, both to reduce law enforcement attention and to maintain a degree of public tolerance for their operations. Some operations restrict targeting to specific geographies.
These restrictions are not enforced through technical controls. They are communicated as affiliate program rules and enforced through exclusion from the program for affiliates who violate them. They do not provide reliable protection for organizations in prohibited categories, because affiliate compliance is voluntary and enforcement is imperfect.
The Specific Threats RaaS Creates for Mid-Market Organizations
Mid-market organizations are the primary revenue target of the RaaS ecosystem because they occupy a specific position that affiliates have learned to exploit.
They hold enough data and generate enough revenue to produce meaningful ransom demands. They frequently lack the security operations capability of large enterprises. They are often in regulated industries with notification obligations that create payment pressure. And they are numerous enough that targeting them at volume produces reliable aggregate revenue even when individual organizations refuse to pay.
The specific vulnerability patterns that mid-market organizations present in the RaaS targeting calculus include:
- Exposed remote access that provides initial access without requiring sophisticated phishing or vulnerability exploitation. RDP exposed to the internet, VPN concentrators running unpatched software, and remote monitoring and management tools with weak credentials are the most common initial access vectors for affiliates purchasing pre-compromised access or conducting their own intrusion.
- Absent or immature endpoint detection that allows the dwell period reconnaissance and exfiltration to proceed without generating alerts. Organizations without endpoint detection and response tools, or with tools deployed but not monitored, provide the attacker an extended undetected presence that maximizes the exfiltration and preparation for encryption.
- Inadequate backup isolation that allows affiliates to locate and compromise backup infrastructure during the dwell period, eliminating the recovery option that would allow the organization to refuse payment without facing extended downtime.
- Limited incident response capability that slows containment once the encryption event is detected, allowing additional spread before containment is complete.
Each of these vulnerability patterns is identifiable through the initial access broker’s reconnaissance and influences the value of access to specific organizations on criminal markets. Closing these gaps reduces not just the probability of a successful attack but the attractiveness of the organization as a target in the affiliate’s selection calculus.
What RaaS Means for Organizational Defense
The RaaS model has specific implications for how organizations should think about their defenses, and those implications differ from what a pre-RaaS threat model would suggest.
Sophistication Assumptions Must Change
Defenses sized for low-sophistication attackers are inadequate against the technical capability that RaaS platforms provide to low-sophistication affiliates. The assumption that small or mid-size organizations are only targeted by less capable attackers, and therefore require less capable defenses, is not supported by the current threat landscape.
The affiliate deploying against a mid-market organization may have limited intrusion skills but is using encryption and evasion capabilities developed by a sophisticated technical team. The defense must address the capability of the platform, not the capability of the individual operator.
Initial Access Prevention Is the Highest-Value Intervention
Because many RaaS affiliates purchase initial access from brokers rather than conducting their own intrusions, closing the vulnerabilities that initial access brokers exploit is the highest-value defensive intervention available. Exposed RDP, weak VPN credentials, and unpatched internet-facing systems are the inventory from which initial access brokers build their listings. Eliminating that inventory removes the organization from the accessible target pool before the affiliate makes a targeting decision.
Multi-factor authentication on all remote access, current patching of internet-facing systems, and elimination of unnecessary external exposure are the specific controls that close the initial access broker’s primary inventory sources. These controls are not exotic. They are foundational security practices that the RaaS threat model makes urgently necessary rather than aspirationally desirable.
Organizations should implement stronger multi-factor authentication and improve their cloud security.
Dwell Period Detection Is the Second Intervention Point
For attacks where initial access is obtained, detecting attacker activity during the dwell period before encryption is deployed is the second intervention point that limits damage. The dwell period in RaaS attacks is not an unfortunate necessity. It is a deliberate operational phase that takes time because the affiliate is conducting reconnaissance, exfiltrating data, and preparing for encryption. That time is the organization’s opportunity to detect and contain the attack before the encryption event occurs.
Detection during the dwell period requires endpoint detection and response tools that identify ransomware-associated behaviors including LSASS memory access, credential harvesting tool execution, lateral movement techniques, and large volume file access across network shares. It also requires that someone is monitoring those tools and responding to alerts, not simply that the tools are deployed.
Organizations should improve their managed detection and response and strengthen their MDR security.
Backup Isolation Is Non-Negotiable
RaaS affiliates are trained to locate and compromise backup infrastructure as a standard dwell period activity. Backup systems that are accessible through the production network and through production credentials will be found and will be compromised by a prepared affiliate before the encryption event. The backup isolation that is strongly recommended for standard ransomware preparedness is functionally required against RaaS affiliates who specifically look for backup infrastructure during reconnaissance.
Organizations should improve their disaster recovery services and strengthen their ransomware protection.
Meet Our CEO, Matt Rosenthal
With more than 30 years of experience in business and technology leadership, Matt Rosenthal has guided organizations across healthcare, finance, legal, manufacturing, and defense through the evolving ransomware threat landscape, including the specific challenges that the RaaS model creates for organizations that sized their defenses against an earlier threat environment. As President and CEO of Mindcore Technologies, Matt leads a team that helps organizations assess and close the specific vulnerability patterns that make them attractive targets in the RaaS affiliate selection calculus.
Matt’s approach to RaaS defense is grounded in the recognition that the industrialization of ransomware has changed who is attacking and what they are capable of, but it has not changed what works defensively. Closing initial access vectors, building dwell period detection, isolating backup infrastructure, and maintaining tested recovery procedures address the RaaS threat as effectively as they addressed its predecessors.
Frequently Asked Questions
How do RaaS groups recruit affiliates?
RaaS groups recruit affiliates through dark web forums, encrypted messaging channels, and by reputation within criminal communities. The recruitment process for established operations includes vetting of applicants to exclude suspected law enforcement infiltrators and affiliates with track records of unreliable operational security. Accepted affiliates receive access to the ransomware builder, victim management dashboard, and affiliate support resources in exchange for agreeing to the group’s terms including revenue sharing percentages and prohibited target categories.
Can law enforcement action against RaaS core groups stop the attacks?
Law enforcement action against RaaS core groups disrupts operations but has not eliminated them. Operations that are disrupted through infrastructure seizure or member arrest frequently reemerge under new names with overlapping membership. The affiliate pool that was using the disrupted platform migrates to alternative platforms, and in some cases core group members reconstitute the operation with improved operational security. Law enforcement action is a meaningful disruption but has not demonstrated the ability to permanently eliminate major RaaS operations. Organizational defense cannot depend on law enforcement action as a primary risk mitigation.
Does paying a ransom to a RaaS operation fund future attacks?
Yes. Revenue collected through ransoms funds the development and operation of the RaaS platform, compensates affiliates for their attack operations, and provides capital for expansion of the criminal operation including recruiting additional affiliates and developing more capable ransomware versions. The payment decision during an active incident must be made based on the specific circumstances of that incident, but the broader consequence of payment to the RaaS ecosystem is real and should be understood as part of the decision context.
How do we know if our organization’s access is being sold on criminal markets?
Dark web monitoring services provide alerts when organizational credentials, network access listings, or other organizational data appears on criminal markets and forums. Cyber threat intelligence services that monitor initial access broker markets can identify when access to an organization’s environment is being actively sold, providing early warning of an imminent attack. Some managed security service providers include dark web monitoring as part of their service offering. Organizations in industries with known high-value targeting profiles should treat dark web monitoring as a standard security operations capability.
Are small organizations at risk from RaaS operations or only mid-size and large organizations?
Small organizations are targeted by RaaS affiliates, particularly those operating at high volume with lower ransom demands sized for smaller organizations. The affiliate economics of targeting small organizations require higher volume to produce equivalent revenue to mid-market targeting, but the lower security capability of many small organizations makes the attacks faster and less risky for the affiliate. Small organizations in regulated industries, including small healthcare practices and small financial services firms, are specifically targeted because the regulatory payment pressure applies regardless of organization size.
Update Your Defenses for the Threat That Exists Today
The ransomware threat that organizations face today is not the threat that existed when most security programs were designed. The RaaS model has expanded the attacker pool, elevated the technical floor of attacks, and introduced systematic targeting intelligence that identifies and prioritizes organizations presenting specific vulnerability profiles.
Defenses built for the old threat model are inadequate for the current one. The organizations that are successfully reducing their ransomware exposure are closing the specific vulnerability patterns that RaaS affiliates exploit, building the dwell period detection capability that surfaces attacker presence before encryption, and maintaining the backup isolation that eliminates the leverage that extended downtime creates.
Mindcore’s cybersecurity services and managed IT services help organizations across healthcare, finance, legal, manufacturing, and defense assess their exposure to the current RaaS threat model and build the defenses that address it. If your organization’s security posture was designed for an earlier threat environment, contact Mindcore to assess what has changed and what needs to change in response.
