Ransomware-as-a-Service: How the Criminal Model Works and How to Reduce Risk
Summary
An explainer on how RaaS developers and affiliates share tools and ransom profits, examples of major operations, and basic steps organizations can take to reduce ransomware risk.
Key points
- RaaS developers provide ransomware tools and infrastructure to affiliates, who carry out attacks and typically keep 70–80% of ransom proceeds.
- The model lowers the technical barrier to launching ransomware attacks; criminal groups may offer starter kits, manuals, and technical support.
- The article describes RansomHub, Hive, Conti, and BlackCat as examples of RaaS operations and their activity.
- Suggested protections include offline backups, MFA, timely patching, and phishing awareness training.
- DarkOwl promotes its Ransomware API for monitoring criminal sites and searching for mentions of organizations.
Article Details
- Topic
- Ransomware-as-a-Service (RaaS)
People
Threat Actors
ALPHVExplicitly identified as another name for the ransomware group BlackCat.BlackCatRansomware group that emerged in 2021 and operated a public data-leak site; also known as ALPHV.ContiProlific ransomware operation whose members dispersed into other ransomware operations after it shut down.HiveRansomware group that operated a RaaS platform and targeted organizations, including healthcare organizations.RansomHubRansomware group operating a RaaS affiliate program and targeting multiple platforms.
Products
ESXiThe group operates a ransomware-as-a-service (RaaS) model, targeting multiple platforms, including Windows, Linux, and ESXi.LinuxThe group operates a ransomware-as-a-service (RaaS) model, targeting multiple platforms, including Windows, Linux, and ESXi.Microsoft WindowsThe group operates a ransomware-as-a-service (RaaS) model, targeting multiple platforms, including Windows, Linux, and ESXi.Ransomware APIProduct Highlight: Ransomware API