Ransomware-as-a-Service (RaaS)

• Business model: core developers build the encryptor and negotiation portal; affiliates do the intrusion.
• Double / triple extortion: encrypt data, steal it, and threaten leaks or DDoS.
• Named examples: LockBit (repeatedly disrupted by law enforcement, 2024), ALPHV / BlackCat, Cl0p (mass exploitation of MOVEit, 2023—2024).
• Why it matters to us: the encryptor is a binary we can triage — file enumeration, crypto APIs, shadow-copy deletion, ransom-note drops.