5 Key Players to Identify in RaaS Operations

Threat Hunting for Ransomware-as-a-Service (RaaS): Detection Playbook

Understanding the RaaS Threat Landscape

Ransomware-as-a-Service has fundamentally transformed the cybercriminal ecosystem by lowering the barrier to entry for devastating attacks. In this model, skilled developers build and maintain ransomware platforms while affiliates — often less technically sophisticated actors — pay for access through subscription fees or profit-sharing arrangements. Groups like LockBit, BlackCat (ALPHV), Royal, and Akira have dominated recent campaigns, each bringing unique tooling but sharing common operational patterns that threat hunters can exploit.

Hiding crypto from your spouse? Courts are catching up.

Unlike traditional ransomware, RaaS operations follow a multi-stage attack lifecycle that typically spans days or weeks before encryption begins. This extended dwell time creates detection opportunities. Effective threat hunting shifts your security posture from reactive alert-driven response to proactive adversary pursuit, identifying threats that bypass automated defenses.

This guide provides a structured playbook for hunting RaaS activity across your environment, covering hypothesis generation, hunt techniques, detection logic, IOC analysis, and threat intelligence integration.

Hypothesis Generation: Where to Start

Every threat hunt begins with a testable hypothesis grounded in intelligence. For RaaS operations, focus hypotheses around the common phases of the attack chain.

Hypothesis 1: Initial Access Brokers Have Established Footholds RaaS affiliates frequently purchase access from Initial Access Brokers (IABs) who compromise networks through phishing, exploited VPN vulnerabilities, or exposed RDP. Hypothesize that an unauthorized remote access session exists in your environment using legitimate credentials.

Hypothesis 2: Lateral Movement Is Occurring via Living-off-the-Land Techniques Affiliates consistently abuse native tools — PsExec, PowerShell, WMI, and RDP — to move laterally. Hypothesize that anomalous administrative tool usage is occurring outside normal baselines.

Hypothesis 3: Data Staging and Exfiltration Precedes Encryption Modern RaaS operations employ double extortion, exfiltrating data before deploying ransomware. Hypothesize that unusual data aggregation or outbound transfers to cloud storage or attacker infrastructure are taking place.

Hypothesis 4: Security Controls Are Being Deliberately Weakened Nearly every RaaS affiliate disables endpoint protection, deletes shadow copies, and modifies security configurations before detonation. Hypothesize that defense evasion activity is occurring silently.

Hunt Techniques: Tactical Approaches

Credential Abuse and Initial Access Hunting

Search for authentication anomalies that suggest compromised credentials or brute-force success. Examine VPN and remote access logs for logins from unusual geographies, impossible travel scenarios, or connections occurring outside business hours. Correlate failed authentication spikes followed by successful logins, which indicate credential stuffing or password spraying.

Lateral Movement Detection

Baseline normal administrative tool usage across your environment, then hunt for deviations. Key indicators include PsExec execution from non-administrative workstations, remote service creation via sc.exe on multiple hosts in rapid succession, and WMI process creation events (Win32_Process) initiated from unexpected source machines.

Hunt for RDP lateral movement by analyzing Windows Event ID 4624 (Type 10 logons) and correlating source-destination pairs that fall outside established administrative patterns. Look for RDP sessions originating from servers or endpoints that have never previously initiated such connections.

Data Exfiltration Indicators

Monitor for archiving tool execution — 7z.exe, WinRAR, tar — targeting sensitive directories such as file shares, database locations, and document repositories. Hunt for large archive files created in temporary directories or staging locations.

Queries and Detection Signatures

Sigma Rule: Shadow Copy Deletion

yaml title: Shadow Copy Deletion - RaaS Pre-Encryption Activity logsource: category: process_creation product: windows detection: selection: CommandLine|contains:

• 'vssadmin delete shadows'
• 'wmic shadowcopy delete'
• 'bcdedit /set {default} recoveryenabled no'
• 'wbadmin delete catalog'

condition: selection level: high

KQL Query: Suspicious Remote Tool Execution

kql DeviceProcessEvents | where Timestamp > ago(7d) | where FileName in ("PsExec.exe","PsExec64.exe","rclone.exe","AdvancedIPScanner.exe","netscan.exe") | summarize ExecutionCount=count(), DistinctHosts=dcount(DeviceName) by AccountName, FileName | where DistinctHosts > 3 | order by DistinctHosts desc

Splunk Query: Anomalous Service Installation

spl index=windows EventCode=7045 | regex ServiceFileName="(?i)(cmd|powershell|mshta|rundll32|regsvr32|certutil)" | stats count by Computer, ServiceName, ServiceFileName | where count > 0

YARA Rule: Ransomware Note Detection

yara rule RaaSRansomNote { strings: $lockbit = "LockBit" ascii wide nocase $alphv = "ALPHV" ascii wide nocase $onion = ".onion" ascii wide $decrypt = "decrypt" ascii wide nocase $bitcoin = "bitcoin" ascii wide nocase condition: ($onion and $decrypt) or ($bitcoin and $decrypt and any of ($lockbit, $alphv)) }

IOC Analysis Framework

Organize indicators across the Diamond Model to contextualize findings and avoid chasing isolated artifacts.

Network Indicators: Catalog C2 IP addresses, domains, and TLS certificate hashes associated with Cobalt Strike, Sliver, or SystemBC beacons — tools favored by RaaS affiliates. Monitor for Tor traffic and connections to known bulletproof hosting providers.

Host Indicators: Track file hashes for known RaaS payloads, but prioritize behavioral indicators since affiliates frequently recompile binaries. Focus on registry modifications disabling Windows Defender (Set-MpPreference -DisableRealtimeMonitoring $true), scheduled tasks establishing persistence, and anomalous DLL sideloading.

Tooling Fingerprints: RaaS affiliates demonstrate strong preferences for specific toolchains. Cobalt Strike, Mimikatz, BloodHound, ADFind, Rclone, and FileZilla appear consistently across campaigns. Detecting any combination of these tools within a short timeframe warrants immediate investigation.

External Threat Intelligence Integration

Operationalize threat intelligence by subscribing to feeds from CISA, MS-ISAC, and sector-specific ISACs that publish RaaS-specific advisories. Integrate indicators from platforms like VirusTotal, AlienVault OTX, and Abuse.ch into your SIEM for automated correlation.

Participate in information-sharing communities. The intelligence you contribute about emerging TTPs strengthens collective defense while providing reciprocal insights that refine your hunting hypotheses.

Conclusion