RaaS groups increasing efforts to recruit affiliates

March 20, 2024 – Published on HelpNetSecurity

Smaller RaaS groups are trying to recruit new and “displaced” LockBit and Alphv/BlackCat affiliates by foregoing deposits and paid subscriptions, offering better payout splits, 24/7 support, and other “perks”.

RaaS operations usually consist of a core group that develops the ransomware and mantains the underlying infrastructure for its deployment, and affiliates that leverage it after breaking into target systems and networks and give the core group a percentage of the ransom as payment for their services.

“There appears to be a shake-up happening in the ransomware-as-a-service (RaaS) ecosystem, largely focused around affiliate structures,” Drew Schmitt, Practice Lead for the GuidePoint Research and Intelligence Team, told Help Net Security.

After analyzing forums and underground marketplaces on the dark web in the wake of Operation Cronos, which struck a considerable blow against the LockBit gang, the analysts have noticed an uptick in advertisements for affiliates.

Read More HERE.