Skip to content

Back to the catalog

How the RaaS Business Model Actually Works
huntress.comarticle

How the RaaS Business Model Actually Works

A Huntress blog post explaining how the Ransomware-as-a-Service (RaaS) model splits ransomware operations into specialized roles - operators who build and maintain malware/leak sites, affiliates who conduct intrusions, and initial access brokers who sell footholds - citing Huntress 2026 Cyber Threat Report data showing Akira, Medusa, Qilin, and Ransomhub accounted for over half of observed ransomware incidents. It walks through a real Huntress SOC incident where attackers pivoted from a compromised SonicWall VPN appliance through privilege abuse, Cloudflared/OpenSSH persistence, credential theft, and shadow copy deletion before deploying Akira ransomware, and recommends monitoring VPN/RDP access, MFA, and SIEM/EDR/ITDR correlation to catch pre-encryption staging activity.

TL;DR Breaks down the RaaS operator/affiliate/IAB business model and traces a real SonicWall VPN-to-Akira ransomware intrusion chain.
Open original ↗

Organisations named here

  • Medusa

Technologies named here

  • Bomgar RMM
  • SonicWall VPN appliance
  • RDP
  • Cloudflared
  • VPNs
  • OpenSSH
  • Managed SIEM
  • Managed ITDR
  • Managed EDR
  • VPN
  • EDR
  • SIEM
  • Huntress
  • SonicWall

Techniques named here

  • Phishing and social engineering
  • Exposed remote access exploitation
  • Help-desk scams
  • Stolen credentials use
  • Rogue/abused RMM tool use
  • Vulnerable edge device exploitation
  • Lateral movement
  • Privilege abuse
  • Persistence establishment
  • Credential theft
  • Firewall tampering
  • Shadow copy deletion
  • Data staging/exfiltration before encryption
  • Defense evasion

Threat actors named here

  • Akira
  • Medusa
  • Qilin
  • Ransomhub
  • Initial Access Brokers

Related in Threat Intel