What is ransomware as a service and how do you defend against it?

Ransomware as a service, or RaaS, is a business model in which one group builds and maintains the ransomware and its infrastructure, and recruited affiliates carry out the attacks. Because many unconnected affiliates run each operation, attack methods vary, so defence has to cover several entry routes rather than one signature.

How does the model work?

CISA's advisory on LockBit describes it directly: the operation functions as a RaaS model where affiliates are recruited to conduct ransomware attacks using the group's tools and infrastructure. The advisory adds that, because there are many unconnected affiliates, the tactics, techniques and procedures observed in attacks vary significantly.

That second point is the practical one. Two victims of the same ransomware family may have been breached in entirely different ways by different people.

What do affiliates and operators each do?

The operators supply the encryptor, a place to publish stolen data, and payment handling. The affiliates find a way in, move through the network, steal data and deploy the encryptor. Money is split between them under terms set by the operator.

CISA's advisory on RansomHub, a RaaS variant, says its affiliates use a double extortion model: encrypting systems and also exfiltrating data to pressure victims. It also notes that exfiltration methods depend on the affiliate who carried out the compromise. So an incident can involve both locked machines and stolen files, and recovery from backups addresses only the first.

Why does the model matter to defenders?

It lowers the skill needed to run an attack, which widens the pool of people who can do it. It also means groups can disappear, rebrand or lose affiliates to a rival and the same intruders continue under another name, so tracking one brand is less useful than hardening against the common entry routes.

What does CISA recommend doing?

The joint #StopRansomware Guide from CISA, the NSA, the FBI and MS-ISAC has two parts. Part 1 covers ransomware and data extortion prevention practices, grouped by common initial access vectors. Part 2 is a response checklist. Using it means you map your own exposure to each vector, instead of buying against a family name.

Is it only large companies that get hit?

The advisories list victims across many sectors. CISA's LockBit advisory says affiliates attacked organisations of varying sizes in sectors including financial services, education, energy, government, healthcare, manufacturing and transportation. Its RansomHub advisory lists water and wastewater, information technology, healthcare and food and agriculture among others. Size and sector do not exempt anyone, which is another reason to start from entry routes, not from a threat list.

A constructed example

A regional manufacturer has remote desktop reachable from the internet on one server, a contractor account without multifactor authentication, and backups on a share that every domain administrator can delete.

An affiliate buys access to the contractor account, logs in, finds the backup share, deletes the copies, copies design files out, then encrypts file servers on a Friday night. Each gap matches a prevention item: close internet facing remote access, require multifactor authentication, and keep offline or immutable backups.

How to check or apply this

1. List internet facing services, especially remote access, and close or protect each with multifactor authentication.
2. Enforce multifactor authentication for all remote and administrative access, including contractors.
3. Patch internet facing systems first, using a known exploited vulnerabilities list to set priority.
4. Keep backups that an attacker with administrator rights cannot delete, and test a restore.
5. Limit administrator accounts and separate them from daily use accounts.
6. Monitor for large outbound transfers, not only for encryption.
7. Write down the response checklist from Part 2 of the CISA guide with named owners and phone numbers.
8. Rehearse once a year with the people who would be called.

Quick check

Sources

• CISA, Understanding Ransomware Threat Actors: LockBit
• CISA, #StopRansomware: RansomHub Ransomware
• CISA, #StopRansomware Guide
• CISA, Known Exploited Vulnerabilities Catalog

Last reviewed: 18 October 2026.