Ransomware-as-a-service (RaaS) is a business model where a core group builds and maintains ransomware, then rents it to affiliates who carry out attacks and share the profits. It has lowered the skill needed to launch ransomware, which is why attacks have multiplied. The whole model runs on dark web forums, channels and leak sites.

What ransomware-as-a-service is

Ransomware-as-a-service is ransomware run like a business. A core group develops the ransomware, maintains the infrastructure to run attacks, and operates the leak sites and payment systems. Rather than carrying out every attack themselves, they rent the whole package to other criminals, called affiliates, who do the breaking in and deploying. When a victim pays, the proceeds are split between the operators and the affiliate.

It is a franchise model for extortion. The operators provide the product and the platform. The affiliates provide the labour and the targets. This division of work is the single biggest reason ransomware has grown from an occasional problem into a constant one.

How the model works

The RaaS model turns a technical crime into a service anyone with intent can buy into. The operators handle the hard parts: writing reliable ransomware, running the negotiation and payment systems, and maintaining the leak site where stolen data is published to pressure victims. Affiliates sign up, gain access to the tooling, and focus purely on compromising organisations and deploying the ransomware.

Because the operators take a cut of every payment, they have an incentive to make their product effective and their affiliates successful. Some even provide support, documentation and dashboards. It is an uncomfortable mirror of legitimate software businesses, built entirely around extortion.

The roles involved

A typical RaaS attack involves several distinct players, often none of whom did the whole job:

• Operators, who build and maintain the ransomware and the surrounding infrastructure
• Affiliates, who carry out the attacks using the operator’s tooling
• Initial access brokers, who sell affiliates a ready-made way into a target
• Other specialists, who may handle negotiation, laundering or data analysis

The victim experiences a single attack, but it was assembled from parts bought and sold across the criminal economy. Understanding that helps explain why disrupting one part, such as the initial access, can prevent the whole chain.

Why RaaS has multiplied ransomware attacks

The defining effect of RaaS is that it lowered the skill barrier. In the past, launching effective ransomware required real technical ability. Now an affiliate can rent proven tooling and focus only on getting in, which many do by buying access rather than earning it. The pool of people capable of running a serious ransomware attack has expanded enormously.

More attackers, using more reliable tooling, against the same set of exposed organisations, produces exactly what the world has seen: a steady rise in ransomware incidents across every sector and size of business.

Where the ecosystem operates

The RaaS ecosystem lives on the dark web. Operators recruit affiliates on forums and channels. Affiliates buy access from initial access brokers in the same places. Stolen data is published on leak sites to pressure victims into paying. This activity spans Tor hidden services, Telegram channels and I2P sites, along with forums and marketplaces.

Watching these networks is how the earliest signs of trouble appear, from an organisation’s credentials being sold to its name showing up on a leak site. No single source has full coverage of the dark web. DarkThreatX maintains broad Telegram monitoring alongside Tor and I2P, which is where much of the recruitment, access trading and data leaking happens.

How stolen credentials feed the model

Most RaaS attacks begin with access, and most access begins with a credential. An exposed password, a stealer log, or a set of VPN credentials sold by an initial access broker is often the first link in the chain. Cut that link and the attack never starts.

This is why credential exposure is so central to defence against ransomware. DarkThreatX monitors Tor, Telegram and I2P around the clock, tracking more than 100 billion records and indexing over a million new stealer logs each week, with alerts in under five minutes so an exposed credential can be found and reset before it is sold and used. The goal is to break the chain at its first link, before an affiliate ever gets in.

To watch for the exposed credentials that feed ransomware attacks, explore enterprise dark web monitoring, or start with the dark web monitoring glossary for the terms behind this ecosystem.

For a wider view of the model, see reputable references such as CISA StopRansomware.

Frequently asked questions

What is ransomware-as-a-service?

Ransomware-as-a-service is a model where a core group builds and maintains ransomware and rents it to affiliates who carry out attacks and share the profits. The operators provide the product and platform, and the affiliates provide the labour and targets, like a franchise for extortion.

Why has RaaS increased ransomware attacks?

It lowered the skill barrier. Affiliates can rent proven tooling and focus only on getting in, often by buying access rather than earning it. That has greatly expanded the pool of people able to run serious ransomware attacks, so incidents have multiplied.

Where does the RaaS ecosystem operate?

On the dark web. Operators recruit affiliates, affiliates buy access from initial access brokers, and stolen data is published on leak sites, all across Tor hidden services, Telegram channels and I2P sites, along with forums and marketplaces.

How do you defend against RaaS attacks?

Because most attacks begin with an exposed credential, monitoring for leaked credentials and resetting them quickly can break the chain before an affiliate gets in. Enforcing multi-factor authentication and detecting exposure early are among the most effective defences.