Security News > 2024 > March > Ransomware as a Service and the Strange Economics of the Dark Web
The past three months have seen dramatic developments among the ransomware ecosystem to include the takedown of LockBit's ransomware blog, BlackCat exiting the ecosystem, and the emergence of several smaller ransomware groups.
Ransomware as a Service has emerged as the dominant business model among large ransomware groups.
Ransomware affiliates work with the broader group to compromise IT infrastructure and distribute ransomware, the ransom itself is then often negotiated by the RaaS provider.
Giving affiliates the hard work of executing successful attacks allows the groups to scale much faster and compromise many more victims than would otherwise be possible while also enabling the groups to continue to innovate on their ransomware code.
Ransomware as a Service groups face the same dilemma as a legitimate business, they need affiliates to make the model work, and have to compete on price and quality to attract the best affiliates.
Reduced affiliate confidence is likely one of the reasons that BlackCat is exiting the ransomware ecosystem after allegedly refusing to pay an affiliate out for a successful 22 million dollar ransom against a major U.S. healthcare entity.