Ransomware as a Service (RaaS)
A cybercriminal business model in which operators rent a turnkey ransomware kit to affiliates in exchange for a share of the ransom.
On February 19, 2024, Operation Cronos, led by the UK's National Crime Agency with the FBI and Europol, took control of LockBit's leak site and of the panel it rented to its affiliates. LockBit was the archetype of ransomware as a service: operators build and maintain the ransomware, the payment infrastructure and the leak site, then rent the package to affiliates who handle intrusion and deployment. The ransom is split on a negotiated key, often around 70 to 80% for the affiliate. That division of labor removes the technical barrier: the affiliate often buys initial access from an access broker, deploys the kit and never needs to write code. DarkSide, the brand behind Colonial Pipeline and its $4.4 million ransom in May 2021, ran the same way. For the cyber insurer, the model explains the industrialization of attacks, the professionalization of ransom negotiation and the correlation of claims when one strain, or one affiliate, hits several insureds at once. The ecosystem is volatile. Brands dissolve and reappear under new names after each law-enforcement action, and an operator can stiff its own affiliates, as ALPHV/BlackCat did in March 2024 after the Change Healthcare ransom, which makes loss history by group a shaky guide.
The LockBit group operated for years on a RaaS model, providing affiliates with a victim-management panel and a leak site for stolen data, until its partial takedown by the international Operation Cronos in 2024.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.