Ransomware as a service (RaaS) is the business model where ransomware developers lease ready-made attack kits to affiliates — criminals who carry out the attacks and split the proceeds, keeping 70-80% of every ransom paid. The developer never attacks anyone; the affiliate never writes code. It is the software-as-a-service model applied to extortion, and it is the reason ransomware attacks have multiplied: a low-skill criminal with a few hundred dollars and a phishing email can now run the same operation as a sophisticated crew. This guide explains how the model works, why it makes ransomware cheaper to defend against than it looks, and what a small business should do in 2026.
TL;DR
- RaaS is crime-for-rent: developers lease ransomware kits to affiliates who run attacks and split ransoms.
- Affiliates handle delivery — phishing, stolen credentials, exploited servers — while the developer handles the malware and the leak site.
- The affiliate model multiplies attacks and professionalises the whole chain, including the negotiation scripts and 'customer support'.
- Most attacks still enter through ordinary doors: phishing, stolen credentials, unpatched servers — the same controls close them all.
- Backups plus MFA plus trained staff remain the answer; no business needs to fight the malware itself to break the business model.
How the RaaS model works
RaaS mirrors legitimate software businesses almost line for line:
- The developer builds and maintains the ransomware, the leak site and the payment infrastructure, taking 20-30% of proceeds.
- The affiliates sign up, receive the kit and a dashboard, and run attacks themselves, keeping 70-80% of every ransom.
- The support infrastructure includes negotiation scripts, victim-shaming leak sites, and — bizarrely but verifiably — 'customer support' channels where victims get help recovering files after paying.
- Specialisation has gone further: some groups outsource initial access to access brokers who sell footholds into networks, and others hire penetration testers to breach targets for them.
The economics explain the growth. An affiliate needs no malware skills, no infrastructure and little capital — just a delivery vector and the nerve to send the email. Lower barrier to entry means more attackers, and more attackers means more attacks, even while any single kit rises and falls in visibility. RaaS kits rise and fall like consumer apps: dominant groups get taken down or exit, and their affiliates simply move to the next kit. The brand changes; the model persists.
Why affiliates target small business
Ransomware crews followed the money downstream as big companies hardened. Small businesses now sit in a sweet spot: enough money to pay a ransom that matters, not enough security staff to stop the entry. The Australian Signals Directorate's threat reporting has consistently placed small business among the most-targeted segments, and the ASD logged more than 84,700 cybercrime reports in 2024-25 — one every six minutes — with small business averaging $56,600 per self-reported incident (ASD Annual Cyber Threat Report 2024-25). A RaaS affiliate running volume attacks does not need every target to pay; they need some to.
How a RaaS attack actually unfolds
- Initial access. The affiliate buys or finds a way in — most often a phishing email that harvests credentials, stolen credentials from an info stealer log, or an unpatched remote-access server. Access brokers increasingly sell these footholds to RaaS affiliates.
- Reconnaissance and escalation. The attacker maps the network, finds domain admin credentials, and identifies backups and file servers.
- Backups and security tools neutralised. The classic pre-encryption steps: backup jobs disabled, shadow copies deleted, endpoint tools killed. This is where unmonitored environments lose their safety net silently.
- Exfiltration. Data is copied out first — data exfiltration enables the double-extortion play.
- Encryption and the note. Files are encrypted and a ransom note demands payment, with a deadline and a leak-site threat attached.
- Negotiation. The affiliate runs the chat, often from prepared scripts. Paying does not reliably end the incident — the data is already out, and victims are frequently re-targeted.
What a RaaS attack costs a business
The ransom itself is only part of the cost. Downtime, recovery, lost revenue, legal and notification costs, and the reputational damage that follows a leak-site posting all add up — which is why the average self-reported small-business cost of $56,600 is often just the start. Businesses with tested backups recover without paying; businesses without them face a choice between a five-figure ransom and an open-ended outage.
Why the defence is cheaper than it looks
RaaS is an industrialised attack, but the entry doors are the same ones every attack uses. That means the defence is a short list, and it is a list small businesses can actually run:
- Tested, offline or immutable backups. The single control that turns a five-figure extortion attempt into a bad afternoon. Tested means a restore rehearsal actually ran recently — an untested backup is a hope, not a control.
- MFA on every account, especially remote access and admin. Stolen credentials — the dominant affiliate entry — hit a wall here.
- Patch internet-facing systems within 48 hours. Exploited VPNs and remote-access servers are the no-click entry the model depends on.
- Egress monitoring. The exfiltration step is visible: bulk outbound transfers before encryption is the signature. Alert on it.
- Train the entry-point decision. Phishing is the affiliate's cheapest door, which makes staff the cheapest control. Cyber Aware's security awareness training rehearses the delivery lures monthly and auto-enrols anyone who clicks into same-day remediation, and human risk reporting shows month by month whether click rates are falling and reporting is rising.
For the controls audit — backups, MFA coverage, patch cadence, egress monitoring — a cyber security gap assessment shows which are in place and which to close before an attacker measures them for you.
FAQ
What is ransomware as a service in simple terms? A criminal business model where ransomware developers lease ready-made attack kits to affiliates, who run the attacks and split the ransom — the developer keeps a share, the affiliate the rest.
How much do RaaS affiliates keep? Typically 70-80% of every ransom paid, with the developer taking the remainder. The split is one of the model's defining features and the reason the ecosystem keeps recruiting.
Do small businesses actually get hit by RaaS groups? Yes — heavily. As large companies hardened, ransomware crews moved downstream: small businesses have money worth extorting and thin defences, which makes them volume targets for affiliates running attacks at scale.
Does paying the ransom end the incident? No. The data is usually exfiltrated before encryption, so paying recovers files but not the leak risk — and victims are frequently re-targeted. Backups plus the controls above are what actually end the incident.
What is the single best defence against RaaS attacks? Tested backups. An attacker who cannot successfully encrypt has no leverage; everything else — MFA, patching, training — reduces the chance of the attempt, but backups remove the leverage entirely.
Is RaaS illegal to even read about? No — understanding the model is legitimate. Operating, distributing or profiting from it is criminal, and law-enforcement takedowns of major RaaS groups happen regularly.
One last thing
Verify one backup this week: pick a file set, restore it, and open it. If the restore works and the data is intact, you have the one control that breaks the RaaS business model against your business. If it does not, that is the gap an affiliate counts on — and closing it costs less than one month of ransomware insurance.
Related guides
- What is ransomware? — the attack itself, explained.
- What is data exfiltration? — the quiet copy that enables double extortion.
- What is a backdoor? — how attackers keep access after the first break-in.