Cybercrime-as-a-Service: How the Underground Started Operating Like a SaaS Company

Early underground forums were unpredictable and built on personal reputation. Operations depended on individual expertise and trust accumulated over years. Importantly, a single arrest or exit scam could end a capability outright.

Today's underground looks different. It runs on standardized offers, written documentation, affiliate programs, tiered pricing, and customer support channels. Criminal operations adopted the operating model of the software industry, for the same reasons the software industry adopted it: specialization scales better than generalism, and recurring revenue beats one-time scores.

AI accelerated the timeline, helping to enable this sophistication. That’s what we’ll dive into today, examining the current cybercrime-as-a-service model.

What Is Cybercrime-as-a-Service?

Cybercrime-as-a-service is a business model where criminal capabilities are packaged, priced, and sold to other criminals as subscription or revenue-share products, rather than being built and used by a single group.

The model breaks the attack chain into specialties, each with its own market:

• Ransomware-as-a-service. Operators build and maintain the encryption tooling, leak site, and negotiation infrastructure. Affiliates handle intrusion and deployment. Revenue splits on a published percentage.
• Phishing-as-a-service. Kits, hosting, anti-detection features, and multilingual templates sold on subscription.
• Initial access brokering. Credentials and established footholds packaged and resold as inventory.
• Malware-as-a-service. Loaders, infostealers, and droppers with update cadences and customer support.
• Deepfake and impersonation services. Voice cloning and synthetic video sold as add-ons to existing fraud workflows.
• Laundering and cash-out. Mule networks and crypto mixing offered as a downstream service.

Specialization is what makes the model durable. A group that only builds tooling never touches a victim network, which changes its legal exposure. An affiliate who only runs intrusions needs no development capability. Risk distributes across the chain, and so does the damage when any one link gets removed.

Ransomware-as-a-Service

Ransomware as a service is the most mature version of the model. The operator supplies the ransomware itself, the leak site, the victim negotiation portal, and often the affiliate onboarding documentation. The affiliate supplies access and execution. Payment splits by an agreed percentage, typically weighted toward the affiliate.

That structure explains a lot of what defenders observe. Tooling consistency across unrelated victims, wide variance in intrusion tradecraft within a single group's victim set, and the speed at which a "new" group appears with mature infrastructure all follow from affiliates moving between operators.

Ransomware trends in 2026

The September 2026 Ransomware Wrap-Up from ZeroFox Intelligence gives the current shape of the market:

• Q3 2026 set a new quarterly record with at least 2,381 R&DE incidents, roughly 14 percent above the previous high of 2,091 set in Q4 2025.
• ZeroFox has recorded at least 6,325 incidents through the first three quarters of 2026, about 32 percent more than the same period in 2025. That leaves the year only 559 incidents short of 2025’s full-year total of 6,884, a gap October is very likely to close.
• Growth is accelerating rather than leveling off. Q2 2026 ran 38.3 percent above Q2 2025, and Q3 2026 ran 67 percent above Q3 2025.
• North America remains the most targeted region at roughly 47 percent of September’s incidents, down from about 59 percent a year earlier. South America grew fastest, up approximately 142 percent year over year.
• Manufacturing is still the most targeted industry at roughly 20 percent of incidents, a position it has held since at least 2021.

The collective rankings show a stable core with heavy turnover beneath it. Qilin, Akira, and The Gentlemen held top-five positions in Q1, Q2, and fall of 2026. The other two slots changed every time: Cl0p and INC Ransom in Q1, DragonForce and LockBit in Q2, INC Ransom and Storm in September.

The Gentlemen show how quickly the model lets a newcomer reach that core: at least 37 incidents in Q3 2025 and 35 in Q4 2025, then 192 in Q1 2026, and the most active collective globally by September 2026. A group can go from marginal to market-leading in two quarters when tooling, affiliates, and access are all things you buy rather than build.

Since Q4 has been the busiest quarter in each year from 2023 through 2025, ZeroFox Intelligence assesses that Q4 2026 is likely to exceed the record just set in Q3.

Double extortion and leak site pressure

Double extortion ransomware encrypts data and steals it, then threatens publication if the ransom goes unpaid. Backups stopped being a complete answer the moment stealing the data became as valuable as locking it.

Leak sites are the pressure mechanism, and they are run with operational discipline including consistent formatting, countdown timers, staged disclosure, and predictable release schedules. Plus, several groups maintain press contact pages. The professionalism is the point, because a victim who believes the threat is credible pays faster.

Takedowns interrupt the model rather than ending it

In February 2024, international law enforcement seized infrastructure associated with LockBit, including its leak site. Within days the group was back online, restoring parts of its operation and communicating with affiliates. By Q4 2025 it ranked among the five most active collectives again.

Operations rebrand and migrate under new names, frequently with the same tooling and the same people. Disruption that targets a single campaign or a single domain buys time. Disruption that targets the economics, meaning affiliate trust, payment rails, and reputational standing, changes behavior.

Phishing-as-a-Service and Access Brokering

Phishing-as-a-service

Phishing kits are sold on subscription with hosting included, anti-detection features built in, and multilingual templates maintained by the operator. An affiliate needs no development skill and no infrastructure of their own. This is why phishing volume and phishing quality stopped trading off against each other, a dynamic covered in more depth in our post on AI phishing attacks.

Initial access brokers

Initial access brokers sit between intrusion and monetization. They compromise an organization, establish persistence, categorize the access by sector, revenue, and privilege level, then list it for sale. A ransomware affiliate buys the foothold instead of building it.

For defenders this layer is the most useful early signal in the entire chain. Access listings frequently precede ransomware deployment by weeks. An organization that finds its own access advertised has a window that almost nothing else in the kill chain provides.

The layers stack into a supply chain. Access broker sells the foothold, affiliate deploys the operator's ransomware, leak site applies pressure, laundering service moves the proceeds. Four parties, one incident.

Where AI Accelerates the Model

Let’s be clear, AI did not create cybercrime-as-a-service. But it did help remove the friction from a model that already worked. 

• Toolkits get refined continuously rather than rewritten irregularly
• Phishing templates update dynamically based on target geography and sector
• Deepfake services bundle into impersonation workflows as a checkbox add-on
• Leak sites maintain consistent formatting and predictable release patterns with less manual effort
• Affiliate onboarding and support scale without proportional staffing

The effect is more sustained operations. Higher volume follows from that, rather than being the goal itself. Campaigns that used to pause when an operator slept now run continuously, and infrastructure adapts faster when disrupted.

When Proof Becomes Part of the Attack

Documentation carries weight in the corporate world. Screenshots validate conversations, email threads establish timelines, and file samples confirm access. Extortion operations understand this and have built their pressure model around it.

Groups running leak sites publish curated samples to demonstrate access. In 2025, the Qilin ransomware group posted sample images of passport scans, driver's licenses, and spreadsheets on its leak site to prove it had stolen data from Estes Forwarding Worldwide. Groups like Rhysida have uploaded snippets of internal documents and financial records for the same purpose.

In those cases the threat actors held real data. The harder question is what happens when they don’t, because the cost of fabricating credible documentation has dropped sharply. Detected AI-generated document fraud increased nearly five times between April and December 2025. Fabricated passports, bank statements, and internal records are engineered to survive an initial review rather than a forensic one.

Put those two facts together and you get the operational problem. When your organization is under a ransom deadline, how much time does your security team have to authenticate the proof before leadership needs a decision? Structural correctness has stopped implying authenticity, and the pressure model is designed to prevent verification from happening at all.

This is why extortion claim validation belongs upstream of the payment conversation. Treat screenshots and samples as inputs rather than conclusions, and check them against intelligence with timestamped lineage before deciding what was taken and what it is worth.

What This Means for Defensive Strategy

The service model changes what effective defense looks like in four specific ways.

Disruption has to target systems. Removing one domain or one campaign against an operation with affiliate distribution and redundant infrastructure produces a short interruption. Sustained pressure on the network, meaning infrastructure, payment paths, and the reputation that keeps affiliates loyal, produces a longer one. ZeroFox runs 1M+ successful takedowns annually with a 95%+ acceptance rate across 80+ Global Disruption Network partners spanning ISPs, registrars, social platforms, and browsers.

Detection has to account for automation. Human-paced triage cannot keep up with machine-paced campaigns. That means automating the high-confidence decisions and spending analyst attention where ambiguity actually exists. Multi-modal AI paired with expert human review produces a 50 percent reduction in false positives, which is what makes the analyst time affordable.

Verification has to account for synthetic artifacts. Extortion claims, leaked samples, and supporting documentation all need validation against a trusted source of record before they drive a payment, a disclosure, or a customer notification.

Early signals have to be correlated, not just collected. An access broker listing, a credential dump, and forum chatter naming your sector mean something different together than they do apart. ZeroFox Cyber Threat Intelligence collects across 2,400+ criminal forums and marketplaces, correlates against 12B+ data points spanning actors, campaigns, IOCs, and infrastructure, and pushes validated findings into your existing stack through 150+ integrations.

For the full analysis of how AI reshaped underground operations and the signals defenders rely on, read the ebook: The Collapse of Ceratinty, AI and the Dark Web