Ransomware-as-a-Service: Inside the Cybercrime Economy

The Industrialization of Ransomware

Ransomware is no longer the domain of lone hackers writing custom malware in basements. In 2025, it’s a multi-billion dollar industry with organizational structures that mirror legitimate SaaS companies — complete with customer support, affiliate programs, revenue sharing, and even bug bounties.

Welcome to Ransomware-as-a-Service (RaaS): where the barrier to entry for conducting a ransomware attack has dropped to near zero.

The RaaS Business Model

┌─────────────────────────────────────────────────┐
│                RaaS Ecosystem                    │
├─────────────────────────────────────────────────┤
│                                                  │
│  RaaS Operator (Developer)                       │
│  ├── Builds/maintains ransomware payload         │
│  ├── Operates leak site and payment portal       │
│  ├── Provides affiliate dashboard                │
│  └── Takes 20-40% cut of ransoms                 │
│                                                  │
│  Affiliates (Attackers)                          │
│  ├── Purchase/lease access to the platform       │
│  ├── Conduct the actual intrusions               │
│  ├── Deploy the ransomware                       │
│  └── Keep 60-80% of ransoms                      │
│                                                  │
│  Initial Access Brokers (IABs)                   │
│  ├── Sell compromised credentials/access         │
│  ├── VPN creds, RDP access, web shells           │
│  └── Prices: $500 - $50,000+ per target          │
│                                                  │
│  Negotiators                                     │
│  ├── Handle victim communication                 │
│  └── Manage cryptocurrency payments              │
│                                                  │
└─────────────────────────────────────────────────┘

Revenue Models

RaaS platforms use several pricing structures:

Model	Description	Example
Affiliate	Revenue split per ransom payment	LockBit (80/20 split)
Subscription	Monthly fee for access to tools	$500-$2000/month
One-time purchase	Buy the ransomware outright	$1000-$5000
Hybrid	Upfront fee + revenue share	Common among mid-tier groups

Anatomy of a RaaS Attack

Phase 1: Initial Access

Affiliates gain entry through:

Common entry vectors (2024-2025 data):
  38% — Exploiting public-facing applications
         (Citrix, VPN appliances, Exchange)
  25% — Phishing with malicious attachments
  18% — Compromised credentials (from IABs or credential dumps)
  12% — RDP brute-force
   7% — Supply chain compromise

Phase 2: Post-Exploitation

Once inside, the affiliate follows a well-rehearsed playbook:

Day 0-1: Initial foothold
  └─→ Deploy Cobalt Strike / Sliver beacon
  └─→ Enumerate Active Directory

Day 1-3: Lateral movement
  └─→ Kerberoasting, credential dumping
  └─→ Move to domain controller
  └─→ Identify backup systems

Day 3-5: Data exfiltration
  └─→ Identify sensitive data (financials, PII, IP)
  └─→ Exfiltrate to attacker-controlled storage
  └─→ Commonly via rclone to Mega.nz or similar

Day 5-7: Deployment
  └─→ Disable security tools (EDR, AV)
  └─→ Delete shadow copies and backups
  └─→ Deploy ransomware across all endpoints
  └─→ Drop ransom note

Phase 3: Double (and Triple) Extortion

Modern ransomware doesn’t just encrypt — it extorts on multiple fronts:

Extortion Layer 1: Encryption
  "Pay us to decrypt your files"

Extortion Layer 2: Data Leak
  "Pay us or we publish your stolen data on our leak site"

Extortion Layer 3: DDoS / Customer Notification
  "Pay us or we DDoS your services AND notify your
   customers/regulators about the breach"

The data leak threat is often more damaging than the encryption itself. Regulatory fines, reputational damage, and customer lawsuits can exceed the ransom amount.

Notable RaaS Operations (2024-2025)

LockBit 3.0

Despite law enforcement’s “Operation Cronos” takedown in February 2024, LockBit rebuilt and continued operations. Their builder was leaked, spawning countless copycat operations:

LockBit characteristics:
  - Custom encryption per victim
  - Bug bounty program ($1000 for vulnerabilities in their code)
  - Affiliate dashboard with real-time stats
  - Auto-generated Tor negotiation portals
  - StealBit exfiltration tool

ALPHV/BlackCat

Written in Rust for cross-platform support (Windows, Linux, ESXi):

Technical features:
  - Configurable encryption (full, fast, auto)
  - Embedded credential harvesting
  - ESXi VM encryption capability
  - Searchable leak site (victims' data indexed)
  - Exit-scammed affiliates in 2024

Akira

Emerged in 2023 with a distinctive retro-themed leak site:

Notable for:
  - Targeting VPN appliances (Cisco ASA/FTD)
  - Linux/VMware ESXi variants
  - Demanded ransoms $200K - $4M
  - Strong Conti lineage in code

Detection and Hunting

YARA Rules for Common RaaS Payloads

rule RaaS_Ransom_Note_Generic {
    meta:
        description = "Detects common ransomware note patterns"
        author = "FuryBee Threat Intel"

    strings:
        $note1 = "Your files have been encrypted" ascii wide nocase
        $note2 = "bitcoin" ascii wide nocase
        $note3 = ".onion" ascii wide nocase
        $tor = "Tor Browser" ascii wide nocase
        $ext1 = ".locked"
        $ext2 = ".encrypted"
        $ext3 = ".ransom"

    condition:
        ($note1 and $note2 and $note3) or
        ($tor and ($ext1 or $ext2 or $ext3))
}

Sigma Rules for RaaS Behavior

title: Shadow Copy Deletion via vssadmin
id: 8a4b8c2d-1234-5678-abcd-ef0123456789
status: stable
description: Detects shadow copy deletion commonly used by ransomware
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'delete'
            - 'shadows'
    condition: selection
level: critical
tags:
    - attack.impact
    - attack.t1490

EDR Telemetry to Monitor

High-confidence ransomware indicators:
  ✓ Mass file rename operations (.locked, .encrypted extensions)
  ✓ vssadmin delete shadows /all /quiet
  ✓ wmic shadowcopy delete
  ✓ bcdedit /set {default} recoveryenabled no
  ✓ Rapid sequential file I/O (encryption in progress)
  ✓ Abnormal use of wmic, psexec, or bitsadmin
  ✓ Rclone or megacmd execution (exfiltration)
  ✓ Disabling Windows Defender via registry/PowerShell

Defensive Strategy

1. Harden Initial Access

# Patch public-facing applications aggressively
# Priority: VPN appliances, mail servers, web apps

# Enforce MFA on all external access points
# Disable RDP exposed to internet
# Use conditional access policies

# Monitor for credential leaks
# Check haveibeenpwned API regularly
curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]" \
  -H "hibp-api-key: YOUR_KEY"

2. Detect Lateral Movement

# Monitor for Kerberoasting
# Windows Event ID 4769 with encryption type 0x17 (RC4)

# Detect credential dumping
# Sysmon Event ID 10 targeting lsass.exe

# Hunt for unusual service account activity
# PowerShell: Get-ADUser -Filter {ServicePrincipalName -ne "$null"}

3. Protect Backups

The #1 ransomware defense: immutable, offline backups

  ✓ 3-2-1 rule: 3 copies, 2 media types, 1 offsite
  ✓ Air-gapped or immutable storage (S3 Object Lock, tape)
  ✓ Test restoration monthly
  ✓ Backup systems on separate credentials/network segment
  ✗ Don't rely solely on VSS shadow copies
  ✗ Don't put backup servers on the same AD domain

4. Segment Networks

Network segmentation limits blast radius:

  ┌─────────────┐     ┌──────────────┐     ┌────────────┐
  │  User VLAN   │────│  Server VLAN  │────│  Backup VLAN│
  │  10.1.0.0/24│    │  10.2.0.0/24 │    │  10.3.0.0/24│
  └─────────────┘     └──────────────┘     └────────────┘
       │                    │                     │
       └─── Firewall ───────┘                     │
                            └──── Air-gapped ─────┘

5. Incident Response Plan

Have a tested plan before you need it:

Ransomware IR checklist:
  □ Isolate affected systems (network disconnect, not power off)
  □ Preserve evidence (memory dumps, disk images)
  □ Identify ransomware variant (ID Ransomware, ransom note)
  □ Check for decryptors (NoMoreRansom.org)
  □ Assess data exfiltration scope
  □ Notify legal, insurance, potentially law enforcement
  □ Restore from verified clean backups
  □ Conduct root cause analysis
  □ Harden based on findings

To Pay or Not to Pay

The uncomfortable reality:

Arguments against paying:
  - Funds criminal operations
  - No guarantee of decryption
  - May violate sanctions (OFAC)
  - Marks you as a willing payer (future targeting)

Arguments for paying (from the CISO's chair):
  - Business continuity (hours vs weeks of downtime)
  - Data leak prevention
  - Sometimes cheaper than recovery
  - Board/stakeholder pressure

Reality: ~37% of organizations paid in 2024
         ~80% of those who paid were attacked again

The best position is to never face the decision. Invest in prevention and resilient backups. The cost of proper security is always less than the ransom.