Somewhere on the internet right now, someone with no technical background is renting the same tools used to take down hospitals, pipelines, and financial institutions. They’re paying a monthly fee. They have customer support. There’s probably a dashboard.
This isn’t speculation. It’s the current state of cybercrime. And the reason attacks have become so frequent, so fast, and so difficult to contain isn’t because hackers suddenly got smarter. It’s because attacking became a service.
The Industrialisation of Cybercrime
For most of computing history, building malware required real technical skill. You needed to understand systems architecture, write your own code, handle your own infrastructure, and find your own targets. The barrier to entry was high enough that serious attacks came from serious actors, nation-states, organised crime groups, and advanced persistent threat teams.
That barrier is gone.
Malware as a Service (MaaS) and Ransomware as a Service (RaaS) changed the economics completely. Today, criminal platforms operate like SaaS businesses: developers build the tools, affiliates pay to use them, revenue gets split, and the whole operation runs with a division of labour that would feel familiar to anyone who’s worked in a tech startup.
The difference is that the product encrypts your files and demands payment to return them.
“Attacking used to require expertise. Now it requires a subscription and a target.”
How the Model Actually Works
RaaS operates on an affiliate structure. The core developers, who are sometimes called operators, build and maintain the ransomware code, the payment infrastructure, the decryption keys, and the negotiation portals. They don’t run the attacks themselves. Instead, they recruit affiliates, people who do the actual targeting, infiltration, and deployment in exchange for a cut of whatever ransom gets paid.
The split is typically 70–80% to the affiliate, 20–30% to the operator. Which means a successful attack on a mid-sized company yielding a $267,500 median ransom, the figure Palo Alto Networks reported in 2025, earns an affiliate roughly $190,000 without them having written a single line of malicious code.
MaaS is broader. It covers the full criminal toolkit, infostealers that harvest credentials, botnets for distributed attacks, phishing kits, exploit frameworks, and access brokers who sell pre-compromised entry points into corporate networks. An attacker assembling a campaign today can rent each component separately, combining them like legitimate SaaS tools in a workflow.
The dark web marketplaces hosting these services look, functionally, like any other marketplace. Reviews. Ratings. Refund policies. Uptime guarantees. Some even offer trial periods.
“The dark web marketplace looked like any other SaaS product page. Reviews. Uptime guarantees. A trial period. The product just happened to be ransomware.”
The Scale of What’s Actually Happening
The numbers in 2026 are not abstract.
55 new RaaS families emerged in 2024 alone, a 67% year-over-year increase. There are now 95 active ransomware gangs being tracked globally, up 40% from the previous year. Over 7,000 organisations were publicly named as ransomware victims on dark web leak sites in 2025, representing a 58% increase from 2024. Ransomware appeared in 44% of all data breaches tracked in Verizon’s 2025 report. The average total cost of a ransomware incident, not the ransom, but the full recovery cost, sits at $4.4 million per IBM’s 2025 data. Healthcare is projected to see 40% of companies hit by ransomware infections in 2026, with the average breach in that sector costing $12.6 million.
And the speed is changing. It now takes attackers hours, not days, to go from initial access to full network encryption. Some operators have achieved complete domain encryption in under four hours.
Then AI Arrived
If RaaS democratised cybercrime, AI is accelerating it.
AI-generated phishing lures have increased click-through rates by up to 54%. Attackers now use generative AI tools to craft convincing emails, impersonate executives, and conduct faster reconnaissance on targets, personalising attacks at a scale previously impossible without large teams.
More concerning: fileless malware now accounts for over 70% of serious malware incidents. These attacks leave no traditional footprint, no file dropped and no signature to scan for. They operate entirely within legitimate system processes, which makes conventional antivirus detection largely ineffective against them. AI agents can probe networks, adapt evasion tactics in real time, and move laterally across systems in under 48 minutes. AI-related illicit malware activity has risen roughly 1,500% since late 2024.
The tools got smarter. The people using them didn’t have to.
How Attacks Actually Get In
The most counterintuitive finding from recent threat intelligence: 79% of initial access attacks are now malware-free. Attackers aren’t breaking in with malicious code anymore. They’re walking in through the front door, using stolen credentials, legitimate remote management tools, and compromised access brokers who sell pre-purchased entry to corporate networks.
Access broker listings on dark web forums increased 50% year-over-year in 2025. An attacker can buy verified access to a specific company’s network, with details about the size of the organisation, the security tools in use, and the domain structure, for a few hundred dollars.
Once inside, attackers don’t move fast. The median dwell time, the period between initial compromise and ransomware deployment, is up to six months. They map the network. They locate and target backups. They identify the most valuable data. Then they encrypt everything at once, maximising leverage.
The backup strategy most organisations rely on is no longer sufficient. Ransomware groups now actively target backup infrastructure as part of standard operating procedure. If your backups are reachable, they’re at risk.
Double Extortion And Why Paying Doesn’t End It
Early ransomware had a simple proposition: pay, get your files back, move on. That model evolved.
Double extortion is now present in 87.6% of ransomware claims. Attackers don’t just encrypt your data; they exfiltrate it first, then threaten to publish it publicly if the ransom isn’t paid. Paying the ransom doesn’t prevent the leak. It just buys negotiation time.
Some groups have moved to triple extortion: encrypting data, threatening publication, and launching DDoS (Distributed Denial of Service) attacks against the victim simultaneously to increase pressure. The leverage compounds.
And the targets have shifted. Ransomware is increasingly focused on small and medium businesses, not because they’re more valuable, but because they’re less defended. A single compromised managed service provider can open access to hundreds of smaller clients simultaneously. One attack, hundreds of victims.
Key Takeaways
- RaaS and MaaS have made serious cyberattacks accessible to anyone willing to pay. Technical skill is no longer required to launch a sophisticated campaign.
- 55 new RaaS families emerged in 2024 alone, a 67% year-over-year increase. 95 active ransomware gangs are currently tracked globally.
- 79% of initial access attacks are now malware-free. Attackers use stolen credentials and legitimate tools, bypassing traditional antivirus detection entirely.
- Fileless malware accounts for over 70% of serious incidents. It operates inside legitimate system processes, invisible to signature-based defences.
- AI-generated phishing has increased click-through rates by up to 54%. AI agents can move laterally across networks in under 48 minutes.
- Double extortion is present in 87.6% of ransomware claims. Paying the ransom doesn’t stop the threat; it just opens negotiation.
- Backups are no longer a safety net unless they’re fully isolated. Ransomware groups actively target backup infrastructure as standard procedure.
- The average total cost of a ransomware incident is $4.4 million, 38 times more than the median ransom itself.
What This Is Really About
Ransomware and malware as a service aren’t technical problems with technical solutions. They’re economic problems. Someone built a better business model for crime: lower entry barriers, higher margins, built-in scale, and distributed risk.
Until the economics of attack become less favourable than the economics of defence, the volume will keep rising.
Law enforcement has dismantled several major RaaS operations: LockBit, ALPHV/BlackCat, and the result wasn’t a reduction in attacks. The ecosystem fragmented. Smaller groups filled the gap. New platforms emerged. The disruptions scattered the industry without stopping it.
The infrastructure of cybercrime is now more resilient than many of the organisations it targets. That’s not a technical observation. It’s a strategic one.
