Ransomware-as-a-Service (RaaS): How the Criminal Franchise Model Works

Ransomware-as-a-Service (RaaS) is the single most important structural change in the ransomware threat landscape over the past decade. Instead of a single group developing malware, deploying it, and collecting ransoms, RaaS splits the operation into two specialised roles: a developer who maintains the encryptor, leak site, and negotiation portal, and a network of affiliates who conduct the intrusions and receive a revenue share (typically 70–80%).

This franchise model dramatically lowered the technical barrier to entry. An attacker no longer needs to write malware or maintain a Tor hidden service — they need only initial access and basic intrusion skills. Groups like LockBit, BlackCat/ALPHV, RansomHub, and Cl0p professionalised the model with affiliate portals, profit dashboards, and even customer support, treating ransomware like a legitimate SaaS business.

The defensive implication is significant: takedown of a single brand rarely eliminates the threat. After Operation Cronos disrupted LockBit in February 2024, affiliates migrated to competing platforms within weeks. The developers and affiliates are interchangeable; the ecosystem persists. Defenders must therefore target the common intrusion patterns — initial access, credential theft, lateral movement — rather than chasing individual brand names.