Ransomware-as-a-Service (RaaS): How Cybercrime Became a Business Model

1. Introduction

Ransomware-as-a-service is a subscription-based model that allows cybercriminals to lease ransomware tools to affiliates, just like a Software-as- a-Service (SaaS) platform.

This article explores how RaaS works, its rise in the cybercriminal underworld History, current active groups, Tactics, techniques, and procedures (TTPs), notable attacks, company losses, and how businesses can defend against this growing threat.

2. Historical Background

RaaS model appeared in the mid-2010s which Simultaneously with the legitimate business growth of Software-as-a-Service (SaaS).

The first known ransomware attack was the “AIDS Trojan” in 1989, which

encrypted filenames on infected PCs and demanded payment by postal mail. It was rudimentary and targeted individuals.

Families of ransomware like Crypto Locker (2013) and Crypto Wall (2014) emerged, encrypting victims’ files and demanding ransoms payable via Bitcoin.

Around 2015, cybercriminals began adopting a service-based model inspired by legitimate cloud software businesses. Instead of writing ransomware and attacking themselves, skilled developers-built malware toolkits and rented them to affiliates. These affiliates, often with limited hacking skills, could launch ransomware attacks by simply “signing up” and using the provided infrastructure.

This was the true birth of Ransomware-as-a-Service. It lowered barriers to entry, multiplied the number of attacks, and created an underground economy where:

• Developers earn a percentage of every successful
• Affiliates conduct attacks and get the
• Customers (victims) pay ransoms to regain access to their

Expansion and Professionalization (2017–2020)

RaaS platforms grew in sophistication. Developers added features like:

• User-friendly affiliate dashboards
• Automated payment portals
• Negotiation chat systems
• Data leak sites to pressure victims publicly

Groups such as GandCrab, Sodinokibi (REvil), and Conti dominated this era, causing massive damage worldwide.

The Modern RaaS Landscape (2021–Present)

Today, RaaS is a mature industry with dozens of active platforms. New tactics like double extortion (encrypt data + leak stolen info) and triple extortion (adding DDoS attacks) increase pressure on victims.

Law enforcement efforts have disrupted some groups (e.g., Hive in 2023), but the model persists because:

• It’s lucrative — millions in ransoms flow through these
• It’s scalable — affiliates worldwide can
• It’s difficult to eradicate — decentralization and anonymity protect

3. Real -World Incidents & Companies Affected

4. Current Active RaaS Groups

5. Tactics, Techniques & Procedures

6. Conclusion

Ransomware-as-a-Service (RaaS) has turned hacking into a business. Instead of writing their own malware, cybercriminals can now rent ready- made ransomware tools to attack companies and demand money.

These attacks are happening more often in 2025, hitting big names like Marks C Spencer and hundreds of other companies. Hackers steal data, lock systems, and threaten to leak information unless a ransom is paid— sometimes costing businesses millions.

To protect themselves, companies need to stay alert: update software, train employees, back up data, and have a plan in case of an attack. RaaS is growing fast, and the best defence is being ready before it happens.