Also known as: RaaS
Ransomware-as-a-service (RaaS) is a criminal business model in which ransomware developers lease their malware and infrastructure to affiliates, who carry out the actual intrusions and share a percentage of ransom proceeds with the operators.
RaaS platforms mirror legitimate software businesses with unsettling fidelity: subscription tiers, affiliate dashboards, technical support channels, and negotiation-as-a-service. This division of labour lets operators focus on malware development while affiliates specialise in intrusion.
The model explains why attribution is difficult and why tactics vary widely under a single ransomware brand name. Different affiliates using the same payload may have entirely different intrusion tradecraft, target selection, and negotiation behaviour.
Ransomware
Ransomware is malicious software that denies an organisation access to its own data — historically by encrypting it — and demands payment in exchange for restoring access or withholding publication of stolen data.
Double Extortion
Double extortion is a ransomware tactic in which attackers steal a copy of an organisation's data before encrypting it, so that refusing to pay risks both operational disruption and public release of the stolen information.
Initial Access Broker
An initial access broker (IAB) is a criminal specialist who breaches organisations and then sells that access to other attackers, such as ransomware affiliates, rather than monetising the intrusion themselves.
Phishing-as-a-Service
Phishing-as-a-service (PhaaS) is a subscription model in which criminal platforms sell ready-made phishing kits, hosting, and credential-capture infrastructure to customers who lack the skill to build them.