# Ransomware-as-a-Service A franchise business model — named by analogy to "software-as-a-service" — that industrialized ransomware. A core **operator** builds and maintains the crypto-locking malware, the payment and leak infrastructure, and the victim-negotiation portal; **affiliates** (effectively contractors) handle the break-ins and deployment; and when a victim pays, operator and affiliate split the take on a pre-arranged cut. RaaS lowered the technical barrier to entry, multiplied the number of attackers, and made ransomware one of the dominant cyber threats to hospitals, schools, pipelines, and governments. ## Double (and triple) extortion Modern RaaS gangs rarely just encrypt. **Double extortion** adds a data-theft step: the attackers *exfiltrate* sensitive files before locking the systems, then threaten to publish them on a public "leak site" unless the victim pays — so even organizations with good backups face the separate threat of disclosure. The tactic spread through gangs like **REvil, Conti, Clop, and DarkSide**, and escalated into **triple extortion** (adding DDoS attacks or directly harassing the victim's customers and patients). The leak-site ecosystem turned extortion into a public spectacle and a reputational weapon. ## The Colonial Pipeline inflection The model's political salience crystallized in **May 2021**, when the RaaS group **DarkSide** hit **Colonial Pipeline**, the largest fuel pipeline on the U.S. East Coast. The company shut operations, triggering panic-buying and fuel shortages across the Southeast, and paid roughly **$4.4 million** in Bitcoin (the DOJ later clawed back about half). Coming alongside REvil's strike on meatpacker JBS and Conti's crippling of Ireland's national health service, Colonial Pipeline reframed ransomware from an IT nuisance into a **national-security and critical-infrastructure** problem, prompting the Biden administration to escalate disruption efforts. ## The Russia nexus The dominant RaaS gangs are Russian-speaking and operate from Russia and allied states, typically coded *not* to attack targets in the Commonwealth of Independent States — a strong tell of where they are based and tolerated. The 2022 **Conti leaks** exposed a gang structured like a corporation and revealed apparent coordination with Russian state interests. The prevailing analysis (see [[Russian State Hacking Groups]]) is that the Kremlin affords these gangs a permissive harbor — declining to prosecute, occasionally leveraging them, and reining them in only when politically convenient — placing RaaS in the gray zone between profit-driven crime and state-aligned disruption. ## Right-wing-KB relevance RaaS matters here as the criminal-economy face of the cyber threat landscape and as a study in **state–crime symbiosis**. It shows how a tolerated criminal ecosystem can deliver strategic disruption to a rival's infrastructure while preserving plausible deniability for the host government — the same deniability logic that runs through this vault's coverage of [[Active Measures]] and the [[Hack-and-Leak Operation]]. Colonial Pipeline also demonstrated how a single extortion event can become a political shock with real-world physical consequences. ## Distinct from neighbors - **[[Wiper Malware]]** — destroys for sabotage with no payday; RaaS encrypts to *extort* for profit. - **Single vs. double extortion** — classic ransomware just locks data; double extortion adds steal-and-leak; triple adds DDoS/contacting victims' customers. - **[[Hack-and-Leak Operation]]** — a *state influence* operation leaking documents to drive scandal; RaaS leaks stolen data purely as *payment leverage*. - **Affiliate vs. operator** — the structural division of labor that defines the "as-a-service" model. ## See Also - [[Cybersecurity Lexicon]] - [[Wiper Malware]] - [[Russian State Hacking Groups]] - [[Active Measures]]