thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Ransomware-as-a-Service (RaaS)

A criminal business model in which ransomware developers lease their malware and infrastructure to affiliates for a share of ransoms.

Definition

RaaS operators provide the ransomware payload, negotiation portals and leak sites, while affiliates handle intrusion and deployment. Profits are split, often with affiliates receiving the majority. The model lowers the skill barrier and explains why the same ransomware family can appear with very different intrusion techniques.

Example

LockBit operated as RaaS, with independent affiliates deploying its encryptor.

Exam tip

Know that RaaS separates developers from affiliates; tracking TTPs per affiliate matters more than the ransomware brand.

Related terms