From the outside, a ransomware attack looks like a single event: a locked screen, a countdown, a demand. Behind it sits a supply chain of specialists who often never meet, never speak on the same channel, and never share a legal identity. One group writes and maintains the malware. Someone else finds a way into your network. A third party handles the extortion chat, sometimes with a script and a shift rota. Understanding who does what is not trivia. It tells you where the attack is fragile, and where your defenses can interrupt it before the encryption starts.
The RaaS model, in plain terms
Ransomware-as-a-Service is a leasing arrangement. A core group builds the encryptor, the data-leak site, the payment portal, and the negotiation chat interface. It then rents that toolkit to affiliates, who do the actual intrusion work. The core takes a cut of every ransom; the affiliate keeps the rest.
That division of labor exists because intrusion and software development are different skills. Writing a stable encryptor that works across Windows, VMware, and NAS devices, then keeping it ahead of endpoint detection, is a full-time job. Getting into a mid-sized manufacturer's network and quietly escalating to domain admin is another. RaaS lets each side focus on what it does well.
Not every program is open to newcomers. Some recruit publicly and take almost anyone. Others are invitation-only, with vetting, deposits, and rules about which countries and sectors are off limits. Those rules are brand management, not ethics.
Who is actually in the room
The ecosystem has recognizable roles. They overlap in practice, and a single person may wear two hats, but the pattern holds.
- Core developers — write and maintain the payload, the leak site, and the affiliate dashboard.
- Initial access brokers (IABs) — sell a foothold: credentials, a web shell, or remote desktop access.
- Affiliates — buy access, move through the network, steal data, and deploy the encryptor.
- Negotiators and extortion desks — run the chat, set deadlines, and manage payouts.
- Infrastructure providers — rent bulletproof hosting, proxy networks, and stolen payment infrastructure.
- Cash-out networks — move cryptocurrency through mixers and over-the-counter brokers.
Initial access brokers: selling the way in
An IAB's product is a single sentence and a set of credentials. "VPN access to a logistics firm, no MFA, domain user." "Web shell on an unpatched server, can reach internal file shares." "Mailbox access with saved session cookies."
Access comes from several places. Some brokers run phishing campaigns themselves. Some buy infostealer logs and filter them for corporate accounts. Some scan the internet for exposed remote desktop services and brute-force weak passwords. The best ones are patient: a single high-value foothold can be held for weeks while buyers are courted.
For defenders, the useful insight is that the breach is usually quiet and boring. There is no malware to catch at this stage. The signals live in identity logs: a login from an unusual network at an odd hour, a successful authentication where MFA was expected, a new account created minutes after a VPN session starts. If nobody reviews those events, the first alert you get will be from your own users, and by then the affiliate has been inside for days.
Affiliates: turning one credential into an outage
The affiliate's job is to convert a bought foothold into leverage. The sequence is familiar, even if the tools vary:
- Reconnaissance of the network, using built-in administration tools rather than custom malware.
- Privilege escalation to domain administrator, often through misconfigured service accounts or unpatched systems.
- Discovery of backups, then deletion or corruption of the ones that are reachable.
- Bulk exfiltration of documents, databases, and email archives.
- Deployment of the encryptor, usually at night or over a holiday weekend.
Affiliate skill varies widely. Some are inexperienced and leave a mess of failed logins and deleted tools. Others are disciplined operators who work entirely with legitimate software, which is why network segmentation and privileged access management matter more than chasing a malware signature.
The extortion desk
Once data is stolen, the chat window opens. Larger programs run it like a support function, with template responses, predictable hours, and staff who handle dozens of simultaneous negotiations. Smaller operations hand it to freelancers who work on commission, or to the affiliate themselves.
Many of these conversations follow a script. The opening message includes proof of the theft, a deadline, and a price. Requests for more time are usually granted, because the point is to keep the victim talking rather than to hold a hard line. Increasingly, some crews skip encryption altogether and simply threaten to publish.
Victims often bring in professional negotiators and incident response counsel. That is a decision for leadership and legal advisors, not for an IT team acting alone. Ransom payments can raise sanctions and legal exposure depending on who receives them, so any engagement should involve qualified counsel before a transfer is considered. This is a legal question, not a technical one.
Splits, escrow, and the value of reputation
Money usually moves through an escrow arrangement set up by the core group, which deducts its share and forwards the remainder to the affiliate. Terms vary by program and by the affiliate's track record, but the pattern is consistent: the affiliate carries most of the operational risk and keeps the larger portion. The core group's share is the price of the tooling and the brand.
That brand has real economic weight. A program that reliably delivers working decryption keys after payment attracts more affiliates and more paying victims. Programs that take the money and disappear lose their affiliates. Disputes, exit scams, and takedowns are routine, and affiliates migrate constantly between programs, which is one reason the names on leak sites change so often while the tactics stay the same.
Where defenders can break the chain
You cannot arrest your way out of this, but you can make yourself an unprofitable target at several points.
- Close the access market. Enforce MFA on VPNs, remote desktop gateways, and email. Remove exposed remote services from the public internet. Audit for accounts with credentials that appear in breach data.
- Watch identity, not just endpoints. Alert on new privileged accounts, impossible travel, and MFA resets. These are the affiliate's earliest footprints.
- Make backups unreachable. Keep at least one copy offline or immutable, and test a restore rather than assuming it works.
- Segment the network. An affiliate who cannot move laterally cannot reach your backup server or your domain controller.
- Rehearse the decision. Decide in advance who calls legal counsel, who talks to insurers, and who owns the negotiation question. Making those choices on day one of an incident is expensive.
None of this is glamorous. It is the same short list security teams have been handed for years, which is exactly why it still works: the ecosystem depends on finding organizations that skipped it.
Photo: tranmautritam / Pixabay
