Definition
A criminal supply model that lets people with no technical skills rent finished tools from a central group and carry out cyber attacks with ease. It's called RaaS, short for Ransomware-as-a-Service. Just as ordinary companies subscribe to software over the internet, attackers rent hacking tools and management systems, then share the criminal profits with the developers.
A franchise restaurant that rents out malware
Picture someone who wants to open a restaurant but has no secret recipes and no idea how to blend a sauce. If they pay a franchise fee to a chain's headquarters, they get everything: ready-made sauce, recipes, even the ordering and payment system.
Ransomware-as-a-service works in exactly the same way. Skilled malware developers play the role of 'headquarters.' They build the ransomware program that locks up the files on a computer in an instant. They also set up a payment website where the victim can talk to the attackers and send the money.
Then another criminal who wants to carry out real attacks signs up with headquarters and rents these tools. The attacker doesn't need to write any complicated code. They get a complete package of ready-made malicious tools and just spread it to target computers through email or security holes.
Anyone can become an attacker in a few clicks
In the past, taking digital data hostage and squeezing money out of victims took a lot of skill. Only top-level hackers who could handle everything alone could pull it off: breaking into systems, file-encryption algorithms, and even crypto money laundering that dodges tracking.
But with ransomware-as-a-service, the barrier to entry dropped sharply. You can now launch an attack by renting a finished tool, even if you can't build malware yourself. Still, breaking into a company's network and spreading through it takes hacking skill. So many groups buy break-in access separately, or accept only experienced partners.
Headquarters even provides an easy-to-use admin dashboard for attackers and hands out manuals that raise the success rate. Some even run a friendly customer support desk that walks victims through buying cryptocurrency and sending the payment. As crime has been split into specialized jobs like this, the number of attacks around the world has exploded.
To be more precise: strict profit sharing and double extortion
The biggest feature of ransomware-as-a-service is its strict 'profit-sharing deal.' When a victim sends cryptocurrency to get their locked files back, the developer at headquarters keeps about 20 to 30% as a platform fee. The distributor who carried out the attack gets the other 70 to 80%. That's how they split the ransom.
To avoid investigators, these groups work in secret on the dark web (an anonymous part of the internet that regular search engines can't find and that you can only reach with a special browser). There they post ads to recruit partners and promote how well their tools work.
More recently, tools come with double extortion built in as a standard feature. The attackers don't stop at encrypting files. They also threaten to leak stolen confidential customer data online unless the victim pays, squeezing the target even harder.
Common misconceptions
Everyone who carries out a ransomware attack is a highly skilled professional programmer.
Since the ransomware-as-a-service ecosystem took shape, even people who can't build malware themselves can rent tools on the dark web and join in attacks. Development, break-in, and distribution are split among different people.
Where you meet it
A case where an attacker who couldn't build malware rented a tool on the dark web and paralyzed the servers of a large retail company
A case where an attacker who handled the distribution sent huge numbers of phishing emails to infect computers, then took 70% of the cryptocurrency extorted
In one sentence
It's a franchise model for cybercrime: developers build and rent out hacking tools, and distributors use them and split the money they make.