[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is Ransomware as a Service (RaaS)? The Dangerous Threat to World Security](/blog/what-is-ransomware-as-a-service) Publish date December 1, 2025 {x} minute read # What is Ransomware as a Service (RaaS)? The Dangerous Threat to World Security [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/the-ultimate-ransomware-defense-guide) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook The Ultimate Ransomware Defense Guide Free resource ### The Ultimate Ransomware Defense Guide [Download now](/resources/the-ultimate-ransomware-defense-guide) Ransomware attacks are on a steep upward trend and the gradient isn't softening its progression. In Q3 2020, ransomware attacks [have increased globally](https://securityboulevard.com/2020/11/40-increase-in-ransomware-attacks-in-q3-2020/#:~:text=The%20US%20observed%20145.2%20million,all%20ransomware%20attacks%20this%20year.) by 40% to 199.7 million cases. In the U.S. alone, attacks have increased by 139% year-over-year, totaling 145.2 million cases in Q3 2020. The impetus to the sudden recent spike in ransomware attacks, was the dramatic shift from a linear attack model, to an insidious multi-dimensional Ransomware as a Service model. To learn how this new ransomware model operates, and how your business can best defend itself, read on. ## What is Ransomware as a Service (RaaS)? Ransomware as a service (RaaS) is a subscription-based model that enables affiliates to use already-developed ransomware tools to execute ransomware attacks. Affiliates earn a percentage of each successful ransom payment. Ransomware as a Service (RaaS) is an adoption of the Software as a Service (SaaS) business model. in the past, coding erudition was a requirement for all successful hackers. But now, with the introduction of the RaaS model, this technical prerequisite has been completely diluted. Like all SaaS solutions, RaaS users don't need to be skilled or even experienced, to proficiently use the tool. RaaS solutions, therefore, empower even the most novel hackers to execute highly sophisticated [cyberattacks](https://www.upguard.com/blog/cyber-attack). RaaS solutions pay their affiliates very high dividends. The[ average ransom demand increased](https://www.bankinfosecurity.com/ransomware-average-business-payout-surges-to-111605-a-14205) by 33% since Q3 2019 to $111,605, with [some affiliates earning up to 80%](https://www.upguard.com/blog/what-is-netwalker-ransomware) of each ransom payment. The low technical barrier of entry, and prodigious affiliate earning potential, makes RaaS solutions specifically engineered for victim proliferation. ## How Does the RaaS Model Work? For the RaaS model to work, you need to start with expertly coded ransomware developed by skillful ransomware operators. The ransomware developers need to be reputable to compel affiliates to sign up and distribute their [malware](https://www.upguard.com/blog/malware). Reputable RaaS developers create software with a high chance of penetration success and a low chance of discovery. Once the ransomware is developed, it's modified to a multi-end user infrastructure. The software is then ready to be licensed to multiple affiliates. The revenue model for RaaS solutions mirrors SaaS products, affiliates can either sign up with a one-time fee or a monthly subscription. Some RaaS solutions, don't have monetary entry requirements and affiliates can sign up on a commission basis. Ransomware affiliates are supported with onboarding documentation containing a step-by-step guide for [launching ransomware attacks](https://www.upguard.com/blog/ransomware-attacks-vs-data-breaches) with the software. Some RaaS distributors even provide affiliates with a dashboard solution to help them monitor the status of each ransomware infection attempt. To recruit affiliates, RaaS post affiliate opening on forums [on the dark web](https://www.upguard.com/blog/dark-web). Some ransomware gangs, [like Circus Spider](https://www.upguard.com/blog/what-is-netwalker-ransomware), only recruit affiliates with specific technical skills, due to their higher chances of [claiming prestigious victims](https://www.upguard.com/news/u-s-treasury-emails-breached). Other ransomware gangs are purely interested in rapid distribution and have very soft affiliate requirements.   Each new affiliate is given a custom exploit code to for their unique ransomware attacks. This custom code is then submitted to the website hosting the RaaS software for the affiliate. With the affiliate hosting site updated, RaaS users are poised to launch their ransomware attacks. ## How Do RaaS Attacks Work? Most ransomware victims are breached through [phishing attacks](https://www.upguard.com/blog/types-of-phishing-attacks). Phishing is a method of stealing [sensitive data](https://www.upguard.com/blog/sensitive-data), such as passwords and payment details, through a seemingly innocuous source. Phishing emails is the most common category of phishing attacks. Victims are presented with an email that seems legitimate, but when they click on a link, they're unknowingly activating a [cyber threat](https://www.upguard.com/blog/cyber-threat). RaaS affiliates present victims with a very convincing phishing email. When a link is clicked, victims are directed to the exploit site where the ransomware is clandestinely downloaded. Since the pandemic, Covid-19 themed phishing emails have been flooding inboxes. These emails seem very convincing, especially to a panic-stricken victim with fragile reservations. [Track supply chain risks with this free pandemic questionnaire template >](https://www.upguard.com/blog/free-template-vendor-pandemic-questionnaire) Once downloaded, the ransomware moves throughout the infected system, disabling firewalls and all antivirus software. After these defenses are comprised, the ransomware may trigger the [autonomous download of additional remote access components](https://www.upguard.com/news/cybercriminals-targeting-australian-health-sector). If a vulnerable endpoint is discovered, such as a desktop, laptop, or even [IoT device](https://www.upguard.com/blog/internet-of-things-iot), it could serve as a gateway to the complete internal network of business. Ransomware that surpasses this depth of penetration is capable of [holding an entire business hostage](https://www.upguard.com/news/law-in-order-attacked-by-netwalker-ransomware). With the ransomware now free to progress without detection, the victim's files are [encrypted](https://www.upguard.com/blog/encryption) to the point of being inaccessible. Most ransomware operates beneath authorized processes, so victims are unaware of any data breaches occurring. After the attack is complete, the extortion game begins. A ransom note written in a TXT file is deposited on the victim's computer. This note instructs victims to pay a ransom price in exchange for a decryption key. Some ransomware gangs, such as [cybercrime group Maze](https://www.upguard.com/blog/what-is-egregor-ransomware), operate on a double-extortion model. They demand a ransom payment in exchange for a decryption key and also threaten to published the breached data on the dark web if payment isn't made before the deadline. The dark web is a criminal-infested network, so [any leaked information on the platform](https://www.upguard.com/product/breach-risk/threat-monitoring) will give multiple cybercriminal groups free access to your sensitive data and those of your customers. The fear of further exploitation compels many ransomware victims to comply with cybercriminal demands. To make the ransom payment, victims are instructed to download a dark web browser and pay through a dedicated payment gateway. Most ransomware payments are made with cryptocurrency, usually Bitcoin, due to their untraceable nature. Each ransom payment is sent to a money launderer that obfuscates the trajectory of the funds so that it cannot be traced to the ransomware developer or the RaaS affiliate. ## The Biggest Ransomware Threats Some of the biggest RaaS ransomware variant threats are: * Satan * Netwalker * Cerber * Egregor * Hostman * WannaCry * Philadelphia * MacRansom * Atom * FLUX * Tox * REvil * Ryuk * Encryptor * Fakben * ORX Locker * Alpha Locker * Hidden Tear * Janus * Ransom3 ## Ransomware: Should You Pay the Ransom? Whether or not you should pay for a ransomware price is a difficult decision to make. If you make a payment, you are trusting that the cybercriminals will deliver on their promise of supplying you with a decryption key. Cybercriminal operations are inherently immoral, you cannot trust criminals to uphold a fragment of morality and follow through with their promises. In fact, many RaaS affiliates don't waste time providing decryption keys to all paying victims, time is better spent seeking out new paying victims. Because a ransom payment never guarantees the decryption of seized data, [the FBI strongly discourages](https://www.fbi.gov/scams-and-safety/common-scams-and-crimes/ransomware) paying for ransoms. [Learn more how to decrypt ransomware >](https://www.upguard.com/blog/how-to-decrypt-ransomware) ## How to Protect Yourself from Ransomware Attacks The most effective [ransomware attack mitigation strategy](https://www.upguard.com/blog/best-practices-to-prevent-ransomware-attacks) is a combination of educating staff, establishing defenses, and [continuously monitoring your ecosystem for vulnerabilities](https://www.upguard.com/product/breach-risk). Here are some suggested defense tactics: * Monitor all endpoints connection requests and establish validation processes * Educate staff on how to identify phishing attacks * [Set up DKIM and DMARC](https://www.upguard.com/blog/spf#toc-how-to-prevent-email-spammers-from-using-your-domain) to prevent attackers from using your domain for phishing attacks. * Monitor and remediate all vulnerabilities exposing your business to threats * Monitor the security posture of all your vendors with [risk remediation software](https://www.upguard.com/product/vendor-risk/risk-remediation) to prevent third-party breaches. * Set up regular data backup sessions * Do not solely rely on cloud storage, backup your data on external hard drives * Avoid clicking on questionable links. Phishing scams do not only occur via email, malicious links could lurk on web pages and even Google documents. * Use antivirus and anti-malware solutions * Ensure all your devices and software are patched and updated. * Provide your staff and end-users with comprehensive [social engineering training](https://www.upguard.com/blog/social-engineering) * Introduce Software Restriction Policies (RSP) to prevent programs from running in common ransomware environments, i.e. the temp folder location * Apply the [Principles of Least Privilege](https://www.upguard.com/blog/principle-of-least-privilege) to protect your sensitive data. [Learn a strategy for obfuscating ransomware attack attempts >](https://www.upguard.com/blog/protecting-employee-credentials-from-ransomware-compromise)‍ eBook The Ultimate Ransomware Defense Guide Free resource ### The Ultimate Ransomware Defense Guide [Download now](/resources/the-ultimate-ransomware-defense-guide) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)