Ransomware used to require significant technical skill to develop and deploy. Ransomware-as-a-Service has changed that — criminal groups license their ransomware to affiliates who handle targeting and deployment, splitting the ransom. This model has dramatically expanded the volume of attacks reaching NZ SMBs.
Ransomware-as-a-Service (RaaS) works like a software licensing business. A criminal development group — sometimes numbering in the dozens of technical specialists — builds and maintains the ransomware platform, the victim communication infrastructure, the decryption portal, and the extortion website. They then license this capability to "affiliates" — typically individuals or small groups with access to target networks but without the technical capability to build ransomware themselves.
The affiliate provides the initial access and deploys the ransomware. When a ransom is paid, the proceeds are split — typically 70-80% to the affiliate, 20-30% to the RaaS developer. Both parties are financially motivated. The developer wants their platform used as widely as possible. The affiliate wants targets that will pay.
Why This Expands the NZ SMB Target Pool
Before RaaS, running a ransomware campaign required significant technical capability. Only sophisticated actors could develop, maintain, and operate ransomware at scale. RaaS decouples the technical complexity from the targeting — an affiliate needs only network access to a target, which can be obtained through purchased credentials, phishing, or exploiting internet-facing vulnerabilities. The ransomware deployment itself is mostly automated.
This has two consequences for NZ SMBs: the number of actors running ransomware campaigns has increased dramatically (because the technical barrier has dropped), and the minimum viable target size has decreased (because affiliates will pursue any target that offers a plausible ransom payoff, even a 10-person firm, rather than needing to hit large organisations to justify the technical investment).
How RaaS Operations Target Victims
Initial access for RaaS campaigns typically comes from: purchased credentials (from dark web markets, sourced from data breaches or previous phishing campaigns), brute-forced remote access (RDP exposed to the internet is actively scanned and credential-attacked at scale), phishing (delivered by either the affiliate or a specialist "initial access broker" who sells footholds to multiple ransomware affiliates), and exploitation of internet-facing vulnerabilities (unpatched VPN concentrators, Exchange servers, and network appliances are frequently exploited).
The Defence Priorities Against RaaS
The RaaS attack chain has multiple points of failure — each control closes an access method: MFA eliminates purchased or phished credentials from working. Removing internet-exposed RDP eliminates one of the primary access vectors. Timely patching closes vulnerability exploitation windows. EDR on endpoints stops the ransomware deployment even if initial access is achieved. Immutable backups restore operations even if ransomware deploys successfully.
The RaaS model is designed to succeed against businesses with gaps in any one of these controls. Layered controls mean the affiliate needs to succeed against multiple successive defences — which dramatically reduces the probability of a successful outcome.
Ransomware-as-a-Service has made ransomware a commodity attack accessible to actors targeting businesses of any size. The defence is the same as it's always been — layered controls at each stage of the attack chain — but the urgency of having those controls in place has increased significantly.
