--- title: How the RaaS Business Model Actually Works | daily.dev description: Ransomware-as-a-Service (RaaS) has transformed ransomware into a scalable criminal supply chain where operators build and maintain malware while affiliates... canonical: https://daily.dev/posts/how-the-raas-business-model-actually-works-ispmjz75g twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How the RaaS Business Model Actually Works | daily.dev og:description: Ransomware-as-a-Service (RaaS) has transformed ransomware into a scalable criminal supply chain where operators build and maintain malware while affiliates... og:url: https://daily.dev/posts/how-the-raas-business-model-actually-works-ispmjz75g og:image: https://api.daily.dev/og/posts/IsPmjz75G.png og:image:alt: How the RaaS Business Model Actually Works og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How the RaaS Business Model Actually Works **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 7 min read · 0 upvotes · 0 comments ## Summary Ransomware-as-a-Service (RaaS) has transformed ransomware into a scalable criminal supply chain where operators build and maintain malware while affiliates carry out intrusions and initial access brokers sell footholds. This division of labor means the same ransomware family can appear in very different attacks depending on which affiliate is involved. Key entry points include phishing, exposed RDP, stolen credentials, and abused RMM tools. A real-world example traces SonicWall VPN exploitation through lateral movement, persistence, and credential theft before Akira ransomware deployment. Defenders are advised to treat ransomware as an intrusion problem, hardening remote access, enforcing MFA, monitoring identity abuse, and correlating signals across endpoints and logs to catch attacker activity well before encryption begins. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Cybercrime Inc.: When hackers are better organized than IT](https://daily.dev/posts/cybercrime-inc-when-hackers-are-better-organized-than-it-bwvfanzec) · CSO Online · 0 upvotes · 0 comments - [Three Factors Determine Whether a Ransomware Group is Successful](https://daily.dev/posts/three-factors-determine-whether-a-ransomware-group-is-successful-qyb0smqmh) · Security Boulevard · 0 upvotes · 0 comments - [How Ransomware Works: Encryption Is the Least of Your Problems](https://daily.dev/posts/how-ransomware-works-encryption-is-the-least-of-your-problems-1qcqveeyz) · Latest Hacking News · 1 upvotes · 0 comments - [Every Ransomware Attack Has a Backstory](https://daily.dev/posts/every-ransomware-attack-has-a-backstory-bzo7w3b2j) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/how-the-raas-business-model-actually-works-ispmjz75g) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How the RaaS Business Model Actually Works","url":"https://daily.dev/posts/how-the-raas-business-model-actually-works-ispmjz75g","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-the-raas-business-model-actually-works-ispmjz75g"},"datePublished":"2026-07-09T20:27:13.231Z","dateModified":"2026-07-09T20:27:39.485Z","description":"Ransomware-as-a-Service (RaaS) has transformed ransomware into a scalable criminal supply chain where operators build and maintain malware while affiliates...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba014204ff01596805afac9b5fe4db59?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba014204ff01596805afac9b5fe4db59?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-the-raas-business-model-actually-works-ispmjz75g","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ransomware","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"How the RaaS Business Model Actually Works"}]} ```