Ransomware-as-a-Service (RaaS)
Ransomware sold as a product: the operator builds the encryptor, the panel and the leak site, affiliates bring the victims, and the ransom splits between them. The reason a small crew can run an enterprise-grade extortion campaign.
Why it matters to you
The brand on the ransom note is not the crew in your network. A RaaS name tells you the tooling, not the operator, and the tradecraft you are facing belongs to whichever affiliate bought in this month.
Where we meet it
Recruitment posts, panel screenshots and affiliate rules are advertising, so they are public by necessity. The internal documents that surface after a dispute are where the operating rules actually get written down.
Connected terms
Partnerka
An affiliate program: the franchise model behind ransomware and stealer operations. The operator supplies malware and infrastructure; affiliates supply victims and split the revenue.
DLS / leak site
A ransomware group's "dedicated leak site": victim announcements, countdown timers and proof packs, published to convert embarrassment into payment.
Double extortion
Steal the data first, encrypt second, and charge for both: one price to decrypt, another not to publish. Increasingly the theft alone, with no encryption at all, because publication is the half that forces payment.
Initial Access Broker (IAB)
A specialist who breaks into organizations and sells the access (VPN, RDP, domain admin) instead of using it. The wholesale layer between opportunistic infection and targeted ransomware.
Where this term stops being vocabulary
Dragnet is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the trade
Access listing
The IAB's ad format: industry, country, revenue, access level and price. Everything except the victim's name, which is disclosed to serious buyers in private.
Bot shop
A marketplace that sells the output of one infected machine as a single unit: its cookies, saved passwords, browser fingerprint and time zone, packaged so a buyer can load the lot into an antidetect browser and resume the victim's sessions.
Carding
The trade in stolen payment card data and the craft of turning it into goods: testing cards, choosing merchants, shipping to reshippers. An economy with its own schools, slang and reputations.
Cashout
The last mile: turning stolen access, cards or balances into money the criminal keeps. Gift cards, crypto, mule accounts, reshipping, each with its own fee and its own specialists.