Ransomware as a service (RaaS) is a criminal business model in which ransomware developers sell or lease their tools to other criminals, known as affiliates, who use them to carry out attacks. The FBI describes it as a developer selling or leasing ransomware to criminal customers. The Canadian Centre for Cyber Security describes affiliate-based models that license malware and share the profits.
Ransomware versus ransomware as a service
The two terms describe different things. Ransomware is the malicious software, or the attack, that blocks access to data, systems or networks and demands payment. RaaS is the supply arrangement behind some of those attacks: one party builds and maintains the tools, and others use them. Not every ransomware incident involves RaaS, and affiliates do not all have the same skills.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Smart Keeper USB-C Port Locks with Key, 4 Blockers 1 Key | $34.82 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Both the FBI and the Canadian Cyber Centre link the model to a lower barrier to entry. The Cyber Centre puts it this way: “We assess that it is very likely that RaaS (ransomware-as-a-service) has lowered technical barriers to entry for threat actors into the ransomware ecosystem and allowed for the proliferation of sophisticated tactics, techniques, and procedures (TTPs) that are leveraged against Canadians and Canadian organizations.”
Free tools Windows power users keep installed
One-click scans. No signup required.
How the model works
Roles differ from one operation to the next, so there is no universal org chart. A common pattern looks like this:
#1 Best Overall
- Bundle: 4 locks + 1 key.
- Easy to Use: It can be installed by hand.
- All-Purpose Key: A common key can be used to unlock 9 different products within the Essential series.
- Developers (operators) build or provide the ransomware tools and maintain them.
- Affiliates use those tools to attack victims. In return, profits are shared with the developers.
- Other tasks, such as negotiating with victims, may sit with either side. The joint FBI, CISA and HHS Medusa advisory says newer affiliates may have negotiation handled centrally by the developers.
- Initial access brokers, in some ecosystems, sell access to victim networks. The Medusa advisory describes them as one source of access.
A worked example: Medusa
The Medusa advisory was first published on March 12, 2025 and updated on August 18, 2026. It says the group moved from a closed operation to an affiliate model by at least early 2023. It is one operation, not a template for all RaaS groups. Useful axes for comparing operations are whether the model is affiliate-based or closed, who handles negotiation, whether data is stolen as well as encrypted, and the date and scope of the source.
RaaS and double extortion
RaaS often goes together with double extortion. The Medusa advisory says its actors encrypt victim data and threaten to publish stolen data. A victim with good backups can restore systems, but backups do nothing about the threat of leaked data. Backups reduce the risk of data loss and downtime, not every extortion risk.
What the numbers say, and what they do not
No single figure measures the whole RaaS ecosystem. Each statistic below applies only to its own scope.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute| Figure | Source and date | Scope |
|---|---|---|
| Over 500 victims | FBI, CISA and HHS Medusa advisory, updated August 18, 2026 | Medusa developers and affiliates only, as of April 2026, across multiple critical infrastructure sectors. Not a global estimate. |
| 13% | Statistics Canada’s 2023 Canadian Survey of Cyber Security and Cybercrime (published October 2024), reported by the Cyber Centre | Share of Canadian businesses that reported cybersecurity incidents and named ransomware as the method. It is not a share of all businesses. |
| 26% average year-over-year increase | Canadian Centre for Cyber Security, Ransomware Threat Outlook 2025–2027 | Recorded Canadian incidents known to the Cyber Centre, 2021 to 2024. The outlook warns that underreporting means actual incidents and payments are higher. |
| 20% rise in reported incidents; 225% rise in reported ransom amounts | FBI IC3, 2020 | Historical US figures from FBI-reported cases, which the FBI said were only a fraction of all incidents. Not a current trend. |
Defensive steps the FBI recommends
The FBI’s ransomware guidance and the IC3 ransomware page are general recommendations. They are not a guarantee against compromise.
- Keep operating systems, software and applications current.
- Keep anti-malware tools updated.
- Back up data regularly and verify that the backups completed.
- Keep backups disconnected from the computers and networks they protect.
- Maintain a continuity plan.
Choosing a backup approach
The FBI does not endorse any device or brand. A disconnected external drive is one possible way to isolate a backup, not a requirement. When choosing, compare three things: how well the backup is isolated from the network, whether you can verify and restore it, and whether it fits the size of your organization.
If an attack happens
The FBI states: “The FBI does not support paying a ransom in response to a ransomware attack.” It adds: “Paying a ransom doesn’t guarantee you or your organization will get any data back.” It also notes that payment can encourage further attacks. Victims can contact a local FBI field office or file a report through IC3. What a particular victim should do depends on the incident, legal obligations and expert advice, so take that advice before deciding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
