Ransomware-as-a-Service (RaaS): Understanding the Criminal Business Model

How ransomware has become a subscription service for criminals.

RaaS enables non-technical criminals to deploy ransomware.

Business Model

- Developers create ransomware
- Affiliates distribute attacks
- Revenue sharing (70-80% to affiliate)
- Support and updates provided

- LockBit 3.0
- BlackCat/ALPHV
- Royal
- Play
- Cl0p

- Immutable backups
- Network segmentation
- EDR solutions
- Email security gateways
- Zero trust architecture