Ransomware-as-a-Service, Rogue Affiliates, and What’s Next

This report analyzes the Ransomware-as-a-Service (RaaS) model using the DarkSide/Colonial Pipeline incident as a case study, describing the roles of operators, affiliates, and Initial Access Brokers (IABs), the risks of outsourced access leading to critical infrastructure attacks, and subsequent industry and criminal-forum responses—such as bans and changes to affiliate rules (e.g., REvil restricting targets)—while highlighting how RaaS may evolve under increased law enforcement and media scrutiny.