Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress

What it is

A Huntress Tradecraft Tuesday write-up (Harlan Carvey, Lindsey O'Donnell-Welch) arguing that the ransomware payload name is a poor predictor of intrusion behavior, because RaaS splits work between operators (who maintain the variant, leak sites, payment portals, negotiation, even legal support) and affiliates (who do recon, initial access, hands-on-keyboard, theft, and encryption). The summary already lists the tradecraft; what it does not carry is the two named incidents and the defensive posture the page recommends.

The MSP amplification pattern

The item worth acting on: a single compromised RMM instance in an MSP-centric environment can hit many downstream victims at once. On April 14, a ransomware campaign reached multiple organizations through a compromised Bomgar remote support environment belonging to a dental software company whose software was installed across dozens of organizations. Separately, a March incident showed actors using Chrome Remote Desktop and AnyDesk for post-compromise persistence.

What to do

The page's recommendations:

• Maintain an asset inventory
• Reduce your attack surface
• Deploy monitoring broadly
• If already compromised, investigate the incident without making assumptions based on branding alone

The operational point behind the last one: the payload name does not tell you the access path, persistence mechanisms, or which controls failed. If you scope an incident by the ransom-note brand and miss the real intrusion path, the same foothold stays available for a return attack — possibly under a different ransomware banner.

Caveats

• The page states EDR/AV killers are "often noisy," so aggressive defense-evasion is not silent — a detection opportunity, not a dead end.
• Attribution is explicitly called "messy": Huntress notes it is usually the affiliate, not the operator, that dictates tradecraft, so intel keyed to an operator name may not describe your actual attacker.

flowchart TD
    B[Ransom note / file extension brand] -->|does NOT reveal| P[Access path, persistence, failed controls]
    A1[Phishing / help-desk scam] --> INT[Intrusion]
    A2[Exposed RDP] --> INT
    A3[Rogue RMM eg Bomgar] --> INT
    INT --> ENC[Same brand deployed]
    A3 -.MSP: one instance.-> MANY[Dozens of downstream victims]
    P -->|scope by brand only| MISS[Real foothold missed]
    MISS --> RET[Return attack, possibly new banner]

The through-line: branding is the least reliable signal in a ransomware case, and the affiliate model is why. Scope on evidence, not on the note.