Browse the site
Services
Who We Serve
Problems We Solve
Across India
Guides & Resources
Questions
Blog
Profiles
Company
Call Get a quote

What is ransomware as a service and why does it hit small firms?

Ransomware as a service, or RaaS, is a subscription model where criminal operators rent ready-made malware, a negotiation desk and often the payment infrastructure. The affiliate only needs a stolen credential to log in and deploy it, which is why RaaS is now the dominant model. Small firms are hit because they are numerous, hold real money and customer data, tend to have weaker controls, and are believed to have more usable insurance. RaaS lowered the skill floor and raised the hit rate, so volume, not sophistication, is now the economics.

Key takeaways

  • Ransomware as a service is now the dominant model, with operators providing malware, hosting, negotiation and sometimes payment processing to affiliates.
  • The model lowered the entry barrier: an affiliate with one stolen VPN or RDP credential can launch a full intrusion without writing any code.
  • Indian small businesses are targeted for the same reason as SMEs elsewhere, which is that they are numerous and hold usable data and insurance.
  • Because RaaS operators broker the negotiation, they often control the price and can exert pressure within minutes of encryption.
  • The practical defensive consequence is that a single exposed remote access credential is now enough, so MFA on remote access has become the priority control.

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

How does ransomware as a service actually work?

It is a supply chain with at least four roles. The developer builds the encryptor, the loader, the data-exfiltration tool and the ransom note, and publishes it on a forum or a Telegram channel. The affiliate is the operator who finds a way in, typically a stolen credential, an exposed remote access service or a phishing payload, and deploys the kit. The broker handles negotiation, often applying pressure and offering a discount for fast payment. And the money launderer converts the cryptocurrency, which is the reason the model reached this scale. The affiliate keeps a share, often 70 to 80 per cent, which is why participation is attractive. The important defensive point is that each role is specialised, so the attacker needs no malware skill, only a way in.

Why are small firms targeted rather than large ones?

Five reasons, and they line up across markets rather than being an Indian peculiarity. Volume: there are simply far more small firms. Value: a small firm may hold customer records, UPI or card references, payroll and supplier data, which is enough to be valuable. Yield: large organisations have mature detection and layered defence, while a small firm often has a flat network and one domain administrator account. Insurance: ransomware operators are widely assumed to target firms with cover, so the payment is more likely. And access: a single exposed RDP or VPN credential is available from credential markets at low cost. The economics reward spraying many small targets with cheap access rather than spending months on one hardened enterprise.

Does the RaaS model change which controls matter?

It sharpens the priority order. If affiliates can deploy a full intrusion with one credential, then MFA and disabling public remote access are the controls that actually cut the top of the funnel. If the payload is commodity, then baseline endpoint protection, application allow-listing for critical servers, and rapid patching of internet-facing systems handle the rest. If exfiltration is part of the standard kit, which it now usually is, then having monitored, retained and centralised logs for 180 days as CERT-In directs changes the outcome, because it is what makes the difference between a two-day and a two-month investigation. And if a broker controls the negotiation, then a rehearsed response plan and a single decision-maker reduce the pressure that a hurried negotiation creates.

What should a small business do differently because of RaaS?

Four practical changes. Treat every credential as an entry point, so enforce MFA on remote access, VPN, email and cloud, and change any password that has ever appeared in a breach notification. Remove public remote access entirely, or put it behind a brokered service with per-user MFA and session recording. Assume data will be taken as well as encrypted, so inventory what you hold, monitor for bulk downloads, and make sure outbound transfers of large files are visible. And rehearse the response, because a brokered negotiation is a pressure campaign: know in advance who decides, who is authorised to talk to the attacker, what your insurance requires, and that the answer is not to pay by default. Businesses that have decided in advance negotiate better and recover faster.

The ransomware-as-a-service supply chain and who does what
RoleWhat they doWhy it matters to you
DeveloperBuilds the encryptor, loader and exfiltration toolsMakes the payload commodity and updatable
AffiliateFinds a way in and deploys the kitOnly needs one credential, not malware skill
BrokerRuns the negotiation and applies pressureCompresses your decision window
Money laundererConverts the ransom paymentCloses the loop, so payment is recoverable to them

What are the frequently asked questions?

What is ransomware as a service and why does it hit small firms?
Ransomware as a service, or RaaS, is a subscription model where criminal operators rent ready-made malware, a negotiation desk and often the payment infrastructure. The affiliate only needs a stolen credential to log in and deploy it, which is why RaaS is now the dominant model. Small firms are hit because they are numerous, hold real money and customer data, tend to have weaker controls, and are believed to have more usable insurance. RaaS lowered the skill floor and raised the hit rate, so volume, not sophistication, is now the economics.
Is ransomware as a service more dangerous than traditional ransomware?
Yes, in practice, because it is cheaper and faster to deploy, it comes with exfiltration built in, and it operates at a scale that turns down the average cost per victim, which lets operators spray many small businesses.
Should I pay if the attacker is a RaaS affiliate?
The model does not change the analysis. Payment does not guarantee a working decryptor, does not remove the operator, and is not covered by many policies. Decide with professional advice on the malware family, and never without insurer consent.
What is the one control that stops most RaaS deployments?
Enforced MFA on remote access, VPN and email, combined with removing any direct exposure of RDP or similar protocols to the internet. The model works on cheap stolen credentials, and MFA makes them much less cheap.
How do I know if my business was hit by an affiliate rather than a lone operator?
The artefacts are similar, and the answer usually comes from forensics: the malware family, the tools dropped alongside it, the exfiltration tooling, and the ransom note itself, which often carries the operator's brand and negotiation details.

Get a straight answer on this

Send us your current remote access setup, and we will check whether a single stolen credential could reach your file server.

Send us the details See pricing

Related

Last reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.