When the Conti ransomware group’s internal chats leaked a few years back, it became strikingly clear how professional the group was. Payroll spreadsheets, performance reviews, and HR complaints about a manager who wouldn’t approve time off were all buried inside thousands of messages that painted a picture of something closer to a mid-size software company than a hacker collective. They just happened to have a felony as their core product.
Since then, hacking groups have continued to professionalize and specialize. The result is a criminal economy built on increasingly solid foundations, and that shift has real consequences for how security teams should be thinking about defense.
This piece breaks down how a RaaS operation is structured today, who gets paid and how much, why the barrier to entry has collapsed in some places but not others, and what organizations should be paying attention to in the future.
The Inner Structure of a RaaS Operation
“RaaS in 2026 is a franchise business with better HR than most startups,” says Mona Rajhans, Senior Engineering Manager at Palo Alto Networks, and that comparison makes sense.
There are essentially four kinds of players. Operators and developers own the platform, the brand, and the underlying infrastructure. They are responsible for building and maintaining the encryption software, the data-leak site, the victim negotiation portal, and the affiliate dashboard.
Affiliates license that platform and do the actual work of breaking into organizations and running attacks. Initial access brokers sit upstream of both, selling ready-made footholds into organizations they’ve already compromised. And then there’s a supporting tier of negotiators, money launderers, and occasionally data analysts who plug into the operation as needed.
The recruitment process is surprisingly professional, and groups focus on bringing on experienced staff who have launched successful attacks or even worked on the other side of the fence in cybersecurity.
“Affiliates must submit their resume of past breaches and undergo a technical interview,” reports Stanislav Kazanov, Head of Cybersecurity at Innowise.
Who Gets Paid, and How Much
The money in a RaaS operation moves in a way that looks more like a software licensing deal than a criminal split. Operators collect their platform fee. Brokers collect for access. Affiliates take on the most risk by actually running the intrusion and managing the extortion, which is also why they keep the largest share of whatever the victim eventually pays.
According to Amit Weigman, Director of Solutions Engineering at Cyngular Security, affiliates typically keep around 70-80%, while the operator who built and maintains the platform takes the remainder as their cut for providing the infrastructure. Access brokers get paid separately and up front for the initial foothold, regardless of whether the eventual attack succeeds or the ransom ever gets paid.
“It functions like a supply chain with a revenue-share agreement, not a gang dividing a pile of cash,” says Amit, who has tracked ransomware threat actors for years.
That separation matters because it changes the economics of the whole supply chain. An access broker who compromises a network has already been paid before an affiliate even decides whether the target is worth attacking.
According to Mona, credentials typically sell for somewhere between $500 and $5,000, depending on the size and sector of the organization behind them. A foothold into a hospital system or a law firm with active litigation tends to command a higher price than access into a smaller, lower-leverage target, since the eventual ransom potential gets priced in from the very first transaction.
The upshot is a payment structure where almost everyone gets compensated for their specific piece of the operation, independent of how the attack as a whole plays out.
Despite the outward professionalism, exit scams are commonplace.
“Developers of RaaS solutions routinely take the cryptocurrency payment from an affiliate, leaving them out of pocket,” reports Stanislav.
The Barrier to Entry Has Collapsed, But Not Evenly
Most platforms now ship with dashboards, around-the-clock support channels, and even user reviews on dark web forums. Instead of writing code, wannabe hackers simply need to click through a guided interface.
“Launching an attack is easier than setting up a legitimate SaaS business,” says Mona.
Dark web ads seeking RaaS affiliates rose 44% in 2024 compared to the year before, a surge that reflects just how accessible and appealing the affiliate model has become.
That accessibility tells only part of the story, though. The skill required to run a RaaS attack hasn’t actually disappeared so much as relocated. The tooling, the encryption builders, the affiliate panels, and the negotiation scripts have become close to point-and-click, but that’s only part of an attack. Getting inside an organization in the first place and staying undetected, still demands real capability.
“What’s been made easy is only the back half of the attack, meaning the encryption and the extortion plumbing,” explains Amit. “The genuinely hard part is still getting inside an organization and staying quiet long enough to matter.”
That said, affiliates can still buy that capability in the form of a ready-made foothold purchased from an initial access broker. As Amit puts it, “The accurate way to think about this shift isn’t that anyone can hack now. It’s that the capability can be purchased one piece at a time.”
Target Selection Is Getting More Deliberate
The old volume approach to ransomware, encrypting as many organizations as possible and hoping a percentage pay, has given way to something far more calculated. Groups are increasingly selective about who they target, weighing cyber insurance coverage, legal exposure, and reputational sensitivity as heavily as the size of the organization itself.
“Operators are chasing quality over quantity,” explains Mona. “They want targets with cyber insurance, legal exposure, and reputational sensitivity. A mid-sized law firm or healthcare provider is more valuable than a larger but less pressured enterprise. The negotiation leverage matters as much as the ransom size.”
How Organizations Can Protect Themselves Against RaaS Attacks
The shift toward longer reconnaissance periods and faster detonation windows means organizations need to adapt their cybersecurity strategy and toolkit accordingly.
For a deeper look at how to build a defense strategy that accounts for the realities covered in this piece, download ProLion’s whitepaper, Advanced Ransomware Defense: Tactics and Strategies for Security Professionals.
And if you’re thinking about ransomware solutions, ProLion DataDefense detects suspicious file activity in real time and blocks ransomware before it can encrypt or exfiltrate data. If an attacker does get through everything upstream of that, DataDefense also allows affected files to be restored with a single click.
