cyber.hendryadrian.com
Interesting Stuff · huntress.com

How the Ransomware-as-a-Service Model Works—and What Defenders Should Watch For

· Original article ↗

Summary

Ransomware-as-a-service divides work among operators, affiliates, and access brokers, enabling varied intrusion paths. The article highlights pre-encryption activity and early access, identity, and staging signals defenders can monitor.

Key points

  • RaaS operators maintain ransomware and related infrastructure; affiliates conduct intrusions, while initial access brokers may sell footholds.
  • The same ransomware family can follow different entry paths, including phishing, exposed RDP or VPNs, stolen credentials, and abused remote-management tools.
  • Attackers may move laterally, steal credentials or data, and disable defenses before deploying encryption.
  • A Huntress SOC example describes SonicWall appliance access followed by privilege abuse, persistence, credential theft, firewall tampering, and signs of Akira deployment.
  • The article recommends hardening remote access, enabling MFA, monitoring suspicious identity and endpoint activity, and correlating signals across systems.
  • Huntress reported that four ransomware groups accounted for over half of observed incidents in its 2026 report, and average time-to-ransom rose from 17 to 20 hours in 2025.

Article Details

Topic
The Ransomware-as-a-Service (RaaS) business model, its roles and intrusion patterns, and ways defenders can detect activity before encryption.

Threat Actors

AkiraRansomware group named among those responsible for over half of observed ransomware incidents; Akira ransomware activity is also described in an incident example.MedusaRansomware group named among those responsible for over half of observed ransomware incidents.QilinRansomware group named among those responsible for over half of observed ransomware incidents; its RaaS model is referenced.RansomHubRansomware group named among those responsible for over half of observed ransomware incidents.

Malware

AkiraIn the Huntress 2026 Cyber Threat Report: State of Ransomware, four groups—Akira, Medusa, Qilin, and Ransomhub—accounted for over half of observed ransomware incidents, which shows how effective shared playbooks have

Products

SonicWallA real example: from SonicWall access to Akira activity

Tools

Bomgar RMM Figure 3: Huntress observed attackers using Bomgar RMM to gain access before launching ransomware.Cloudflaredwithin hours. The observed tradecraft included privilege abuse, lateral movement, persistence using Cloudflared and OpenSSH, credential theft, firewall tampering, shadow copy deletion, and eventually signs of AkiraOpenSSHThe observed tradecraft included privilege abuse, lateral movement, persistence using Cloudflared and OpenSSH, credential theft, firewall tampering, shadow copy deletion, and eventually signs of Akira ransomware

Related Articles