How Ransomware-as-a-Service Affiliates Divide Work and Share Profits

Summary

The article explains how ransomware-as-a-service operators and affiliates divide roles, share revenue, and conduct extortion, and why affiliate activity can persist as ransomware brands are disrupted or rebranded.

Key points

• RaaS operators typically maintain ransomware, infrastructure, and affiliate support; affiliates conduct intrusions, steal data, negotiate, and may deploy encryption.
• Initial access may come from stolen credentials, exposed services, or access purchased from initial access brokers.
• Many operations prioritize data theft and extortion; encryption may be secondary or absent.
• Programs commonly split ransom proceeds, with affiliates receiving the larger share, while operators compete for affiliates through revenue splits, support, and infrastructure.
• Affiliate movement between disrupted or rebranded groups can carry intrusion patterns and targeting across ransomware brands.
• Leak-site postings are an imperfect measure of activity and do not capture failed extortions, private settlements, or unposted victims.