Ransomware as a Service (RaaS) is a cybercrime business model where core operators develop ransomware payloads, leak sites, and negotiation infrastructure, then recruit affiliates to breach victims. Affiliates often purchase initial access from brokers who source footholds from infostealer logs and exploit vulnerabilities.
RaaS lowered the barrier to entry for ransomware attacks and contributed to the surge in incidents across healthcare, manufacturing, and technology sectors. Understanding the supply chain from infostealer infection to RaaS affiliate deployment helps defenders prioritize the earliest exposure signals.
Read about a RaaS group built on infostealer credentials in our Gentlemen ransomware blueprint.