Security News > 2024 > March > RaaS groups increasing efforts to recruit affiliates

Smaller RaaS groups are trying to recruit new and "Displaced" LockBit and Alphv/BlackCat affiliates by foregoing deposits and paid subscriptions, offering better payout splits, 24/7 support, and other "Perks".

RaaS operations usually consist of a core group that develops the ransomware and mantains the underlying infrastructure for its deployment, and affiliates that leverage it after breaking into target systems and networks and give the core group a percentage of the ransom as payment for their services.

Three RaaS groups, in particular, are trying to attract affiliates by taking different approaches.

"As objective outside reviewers, we considered Medusa's post particularly appealing, as the group claims a sliding payout scale, starting at a 70/30 affiliate/core split, increasing up to 90/10, dependent on the size of the ransom payment obtained; only affiliates in receipt of a $1 Million+ ransom is eligible for a 90/10 split, likely incentivizing or creating the appearance of high ransom demands," the analysts noted.

RansomHub, on the other hand, is apparently trying to rebuild some of the trust RaaS gangs in general have lost due to the latest takedowns and possible exit scams, by saying that its affiliates will be allowed to collect ransom payments themselves before paying the "Service fee" and that affiliates with be premitted to participate in multiple RaaS groups.

The advertisements from less known RaaS groups without a well established reputation are being met with doubts, but that's not unusual.

News URL

https://www.helpnetsecurity.com/2024/03/20/raas-recruit-affiliates/