RaaS (Ransomware as a Service)

What is Ransomware as a Service (RaaS)?

Ransomware as a service (RaaS) is a business model on the dark web that encourages cybercriminals to develop ransomware software and then sell or lease it to other criminals for profit.

Ransomware is a type of malware that locks the victim out of a computer system by encrypting the victim’s own data. The attacker then contacts the victim to demand a ransom payment in exchange for the decryption key.

Table of Contents Table of Contents

1. What is Ransomware as a Service (RaaS)?
2. Key Takeaways
3. How RaaS Works
4. How RaaS Has Changed
5. What are the RaaS Revenue Models?
6. Why is RaaS Dangerous?
7. Examples of RaaS Exploits
8. 5 Tips to Prevent RaaS Attacks
9. Is Ransomware as a Service Legal?
10. RaaS Future
11. The Bottom Line
12. FAQs
13. References

Show Full Guide

Table of Contents

1. What is Ransomware as a Service (RaaS)?
2. Key Takeaways
3. How RaaS Works
Show Full Guide
4. How RaaS Has Changed
5. What are the RaaS Revenue Models?
6. Why is RaaS Dangerous?
7. Examples of RaaS Exploits
8. 5 Tips to Prevent RaaS Attacks
9. Is Ransomware as a Service Legal?
10. RaaS Future
11. The Bottom Line
12. FAQs
13. References

How RaaS Works

Essentially, the RaaS business model allows threat actors with general technical skills to conduct sophisticated data extortion attacks.

Many RaaS operators today use fairly traditional cloud service provider business models. They lease infrastructure, create and maintain ransomware software and tools, package RaaS resources into user-friendly kits, and use ads to reach potential customers.

There are a few important differences between legitimate software as a service (SaaS) providers and RaaS operators, however.

For example, once a potential affiliate creates an account with ransomware as a service platform, they will be vetted. Because RaaS providers and affiliates operate within a cybercrime culture, payments are almost always made in cryptocurrency to provide anonymity.

How RaaS Has Changed

Until fairly recently, RaaS was associated with lone developers who used inexpensive spyware to gather information about a potential target. After reconnaissance, they’d set up a tailored attack and then sell the instructions and necessary tools to a fellow criminal.

Today, RaaS operations are typically run by foreign nationals and organized criminal gangs who prefer to share profits rather than sell ransomware toolkits. This provides the operator with a steady income stream and motivates them to continually improve their malware and services.

What are the RaaS Revenue Models?

A revenue model is a strategy that a business uses to generate income.

Commonly used revenue models for RaaS include:

Why is RaaS Dangerous?

The RaaS business model has lowered the entry bar for cybercriminals and made it easier for gangs of criminals to scale their illegal activities.

Examples of RaaS Exploits

In 2024, the U.S. Federal Bureau of Investigation, along with the Cybersecurity and Infrastructure Security Agency, confirmed that RansomHub ransomware as a service has targeted organizations across nearly every industry worldwide and encrypted and exfiltrated data from at least 210 victims.

Here are some examples of other well-known exploits:

• LockBit 3.0 affiliates are known to have targeted major corporations like Boeing and the Industrial and Commercial Bank of China.
• BlackCat (ALPHV) affiliates are known for using social engineering and malvertisements to deploy ransomware.
• Dispossessor, a ransomware platform that is often compared to LockBit, is often credited with popularizing a dual-extortion RaaS business model that demands two ransoms.

5 Tips to Prevent RaaS Attacks

RaaS cybercriminals often deliver malware through automated exploit kits, malicious advertisements, and sophisticated spear phishing emails.

Safeguarding against RaaS exploits requires a strong risk management strategy that includes:

Is Ransomware as a Service Legal?

Ransomware as a service is illegal because the malware enables cybercriminals to gain unauthorized access to computer systems and networks.

Criminals who conduct this type of attack can be very difficult to catch, however. They typically use layers of anonymization techniques to hide their identity and often operate in jurisdictions that have weak data privacy laws and limited cooperation with international law enforcement.

RaaS Future

As RaaS providers increasingly use artificial intelligence (AI) to streamline their business models, law enforcement agencies are concerned that the number of ransomware attacks will only increase.

AI is already helping RaaS operators automate low-level malware development tasks and anonymize their communication with affiliates more effectively.

In the future, it’s likely that AI integration will allow smaller, more low-profile RaaS operators to extend the scale of their operations and even automate ransom negotiations with victims.

The Bottom Line

The definition of RaaS has evolved over time in response to the profitability of this cybercrime business model. Twenty years ago, when bad actors sold ransomware malware, it was a simple one-time transaction. Today, ransomware as a service has transformed into a multi-billion dollar full-service business model that’s often run by gangs of cybercriminals.

FAQs