Ransomware attacks carried out to order, as well as a platform for the provision of such services. Typically, RaaS includes the leasing of ransomware or a blocker, botnet services for malware delivery, and a control panel. Through a personal account, the attacker can control the basic attack parameters and communicate with the victim.
The C&C servers of RaaS platforms are located in a darknet; their owners look for clients in specialized private forums. Some services also offer clients flexible tariff plans, technical support, and even training.