Intelligence
What is Ransomware-as-a-Service?
A business model where ransomware developers rent their malware and leak site to affiliates who carry out attacks, splitting the ransom.
Ransomware-as-a-Service, or RaaS, is a criminal business model. A core group builds and maintains the ransomware, the payment portal and the leak site. Affiliates break into victims and deploy it, and the ransom is split between them, often with most of it going to the affiliate.
The model explains why one ransomware name can appear in very different attacks. The tooling is shared, but the intrusion methods depend on which affiliate carried it out.