Criminal business model where ransomware developers provide tools to affiliates for a share of ransom payments.
Ransomware as a Service (RaaS) is a criminal business model where ransomware developers create malware and provide it to affiliates who conduct attacks. The developers handle malware development, payment infrastructure, and negotiation, while affiliates focus on gaining access to victims. Profits are split, typically 70-80% to affiliates. RaaS has industrialised ransomware, lowering barriers to entry and enabling less sophisticated criminals to launch devastating attacks. Major RaaS operations include LockBit, BlackCat, and their successors.
Why It Matters
The DSC Perspective:
RaaS means ransomware attacks are no longer limited to sophisticated criminals. The threat landscape has expanded dramatically. Any organisation is a potential target, regardless of size or industry.