Ransomware-as-a-Service Defence: Stopping the Business Model, Not Just the Malware
RaaS turned ransomware from a crime of skill into a business of scale. Defending against the business model requires a different control set than defending against the malware.
Ransomware stopped being a malware problem around 2020. The change was not technical — the encryption was the same — but structural. Ransomware-as-a-Service turned attack operations into a franchise model: developers build the malware, affiliates carry out the intrusion, and a help desk negotiates the ransom. The skill floor collapsed, the volume exploded, and the playbook standardised.
Defending against RaaS means understanding that you are not fighting a piece of malware. You are fighting a business that needs three things to succeed: initial access, dwell time, and the ability to destroy recovery options.
How the RaaS kill chain actually works
| Stage | What happens | Where to break it |
|---|---|---|
| Initial access | Phishing, exposed RDP, compromised VPN credentials, or a purchased access from an initial access broker | MFA on everything remote; zero exposed management interfaces |
| Discovery and movement | Affiliate maps the network, escalates privileges, finds backup systems | Network segmentation; privileged access management; EDR with behavioural detection |
| Staging | Exfiltration for double extortion; deployment across as many hosts as possible | Outbound traffic monitoring; egress filtering; data loss prevention |
| Execution | Mass encryption across the estate in a coordinated window | EDR in block mode; application allow-listing; rapid isolation capability |
| Monetisation | Ransom demand backed by threat of public data release | Tested recovery; legal and communications plan; cyber insurance with prior agreement |
The controls that actually change outcomes
1. Immutable, tested, separated backups
Not backup software. Backups that an attacker with domain administrator credentials cannot reach — offline, immutable, or in a logically separated identity tenant. And tested by actual restoration, because the first time you discover your backups are incomplete should not be during an active incident.
2. Multi-factor authentication on every remote path
RaaS affiliates predominantly enter through exposed remote access: VPN, RDP, webmail, admin panels. MFA on every one of these removes the cheapest initial access vector. Phishing-resistant MFA — passkeys or FIDO2 — removes the cheapest bypass of that defence.
3. Network segmentation that separates blast radius
A flat network means one compromised host reaches everything. Segmentation does not need to be architecturally perfect; it needs to separate the things that matter most — backup infrastructure, identity systems, operational technology, finance — from the general estate.
4. Endpoint detection and response with active blocking
EDR that only alerts is a notification system. EDR configured to block known ransomware behaviours — mass file modification, shadow copy deletion, suspicious command execution — is a control. The configuration matters more than the brand.
5. A tested incident response plan
A plan on a shelf is theatre. A plan that has been rehearsed — with named contacts, pre-agreed external responders, legal counsel briefed on notification timelines, and a decision-maker empowered to authorise isolation — is the difference between a contained event and a crisis.
Building ransomware resilience, not just ransomware defences
The organisations that recover quickly are not the ones with the most tools. They are the ones who tested the plan before they needed it, and who built recovery as a capability rather than a hope.
Kinematic Digital designs and operates security programmes for mid-market and enterprise organisations. See our cybersecurity services and preemptive security programme, or book a security review.
Frequently Asked Questions
What is ransomware-as-a-service?
A criminal business model where ransomware developers license their malware to affiliates who carry out attacks, splitting the ransom. It lowers the skill barrier to entry and produces professional, well-supported attack operations.
Does paying the ransom guarantee data recovery?
No. FBI and CISA guidance discourages payment. Even when decryption keys are provided, recovery is often partial, files are corrupted, and paying marks you as a willing payer for future attacks.
What is the single most effective ransomware defence?
Immutable, offline or air-gapped backups that are tested by restoration. No attacker can encrypt what they cannot reach, and tested recovery means you can rebuild without negotiating.
Should we buy cyber insurance instead of investing in defences?
Insurance is a backstop, not a strategy. Insurers now require demonstrated controls — MFA, EDR, tested backups, incident response plans — before coverage or payout. Weak controls mean no policy or no payout.
How long does ransomware recovery take?
For a mid-size organisation, full recovery from a tested backup takes days to weeks. Without tested backups, organisations face weeks to months of disruption, with some never fully recovering.