Ransomware as a service, or RaaS, is a model in which one group builds and maintains ransomware tools and infrastructure, and recruited affiliates carry out the attacks using them. Because many unconnected affiliates run their own campaigns, attack methods vary widely, which makes one-size-fits-all detection harder.
What is ransomware in the first place?
CISA describes ransomware as malware designed to encrypt files on a device so the files and the systems that rely on them become unusable, after which the actors demand ransom for decryption. Many actors also threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. That is double extortion, so restoring from backups addresses the encryption but not the leak threat.
How does the RaaS model work?
CISA's joint advisory on LockBit, published 14 June 2023 with the FBI, MS-ISAC and international partners, gives a clear case. It says the LockBit operation functions as RaaS, where affiliates are recruited to conduct ransomware attacks using LockBit tools and infrastructure. In 2022 it was the most deployed ransomware variant across the world, according to the advisory, and since January 2020 affiliates have attacked organizations of all sizes across critical infrastructure sectors including financial services, food and agriculture, education, energy, government, healthcare, manufacturing and transportation.
The advisory makes the key defensive point: because of the large number of unconnected affiliates, observed tactics, techniques and procedures vary significantly, which presents a notable challenge for network defenders. It also says affiliates have used double extortion since 2021. The advisory is a snapshot from 2023, and newer reporting may have changed the picture, so check CISA for updates.
Think of it as a franchise. The core group owns the brand, software and leak site. Affiliates own the break-in. That split is why you see wide differences in how intruders enter, even when the same ransom note appears.
Why does this matter to the defender?
Researchers who study the underground economy describe a loose federation of specialists who sell capabilities, services and resources, from which modern criminal entrepreneurs piece together à la carte components. RaaS is one expression of that: someone else supplies the encryptor, another supplies stolen credentials or initial access. The barrier to entry drops, and the number of capable attackers grows.
For you, the practical result is that the first stage varies, and the later stages look alike: gaining privileges, moving across the network, deleting recovery options, encrypting and exfiltrating. The advisory lists techniques such as deleting volume shadow copies and stopping services. Defenses aimed at those later stages work against many affiliates at once.
What does CISA recommend?
The advisory's mitigations, mapped to CISA and NIST cross-sector performance goals, include:
- Sandboxed browsers to protect hosts from malware that arrives through web browsing.
- Strong password policy: passwords of at least 15 characters, screening for known-compromised passwords, lockouts after repeated failures, and multifactor authentication.
- Securing internet-exposed services, patching, disabling macros and application allowlisting.
- Logging and alerting.
- Backups kept to the 3-2-1 pattern: three copies, on two media types, one copy off-site, with backup data encrypted, immutable and covering the whole data infrastructure.
CISA's Ransomware 101 page points to the joint #StopRansomware Guide, updated May 2023, which includes best practices and a response checklist that can be added to an incident response plan.
What does it look like in a small company?
Constructed example. A 150-person firm has a remote access gateway with a known vulnerability, unpatched for three weeks, and a file server reachable from every laptop. An affiliate buys access to the gateway, logs in as a stolen administrator, copies the file server to an external host, deletes shadow copies and starts the encryptor on Friday evening. Four defensive layers, patching the gateway, multifactor sign-in, segmentation of the file server, and immutable backups, each would have changed the outcome.
How to check or apply this
- List every internet-facing service and when it was last patched. Fix the oldest first.
- Require multifactor authentication for remote access and every administrator account.
- Segment so that no laptop can reach every file server.
- Make at least one backup copy immutable and test a full restore.
- Alert on mass file changes, shadow copy deletion and large outbound transfers.
- Write your response plan, including who calls whom, before an incident.
- Plan for data leak decisions: legal, customers and regulators, separate from recovery.
Quick check
Does paying the ransom end the problem?
Not reliably. CISA notes that actors often threaten to sell or leak exfiltrated data, so a decryption key does not remove that threat. Treat the decision as a legal and executive one, and use law enforcement guidance.
Why do RaaS attacks look different from each other?
Different affiliates run them with their own methods. The shared tool leaves similar late-stage traces, so focus defenses there as well as at the front door.
Sources
- CISA Advisory AA23-165A: Understanding Ransomware Threat Actors, LockBit
- CISA: Ransomware 101
- Thomas et al., Framing Dependencies Introduced by Underground Commoditization
Last reviewed: 18 October 2026.
