Ransomware affiliate recruitment: the labor market behind RaaS brands
When a new ransomware brand appears, the encryption code is rarely the news. What a brand needs first is affiliates: operators who bring their own intrusions into corporate networks, run their own negotiations and hand the brand a cut of every ransom. The recruitment trail those brands leave - pinned forum threads, rules pages, Telegram channels - is one of the better-documented parts of the ecosystem, and it reads less like malware distribution than like a labor market.
Where the ads run
The main stage is a handful of Russian-language forums: Exploit, XSS and RAMP. Ransomware talk is formally banned on the top-tier boards, so advertisers fall back on coded language. Flashpoint documented the pattern in 2021: users offering to buy VPN, Citrix and RDP accesses “for a percentage of the profit” while describing themselves as “a team of experienced pentesters”, one citing past work with DarkSide as a credential. ReliaQuest's 2022 study of the recruitment funnel describes pinned RaaS threads in which the word ransomware is off-limits on Exploit and XSS - groups say they are “looking for pentesters” - while RAMP allows full detail. When RansomHub launched, Recorded Future traced its first advert to a user named koley on RAMP in early February 2024; the brand had claimed 45 victims across 18 countries by the time of the analysis. Telegram now carries much of the same traffic. A Cyfirma analysis published in February 2026 describes ransomware channels that “advertise affiliate programs, outline commission structures, publish targeting restrictions” - excluded regions and sectors - next to access brokers selling VPN, RDP and cloud entry points. The report's summary of the division of labor: forums provide visibility, while Telegram “handles the execution”.The split on offer
Advertised splits give the affiliate the clear majority. LockBit paid 80 percent of a collected ransom in 2022, according to ReliaQuest. Recorded Future describes RansomHub's 90 percent as “on the higher end of the typical 80-90% range seen in the RaaS market” - a rate “likely to attract seasoned affiliates from other platforms”. In 2025 the Anubis brand formalized three modes: classic RaaS at an 80 percent share, a data-only extortion service, and an access-provision scheme paying 50 percent of ransoms to whoever supplied the initial way in. The operator's residual share pays for the bundle: the encryptor and builder, leak-site hosting, negotiation support, and a brand name that adds pressure to victim conversations. Perks are part of the pitch. Recorded Future notes Qilin introduced a “Call Lawyer” service in mid-2025, offering affiliates legal consultation on how to intimidate victims during negotiations. LockBit, in its 2022 recruitment push, offered $1,000 to forum users willing to tattoo the group's logo; at least three did.Vetting the applicants
Recruitment is filtered at several stages. Some leak sites run a “Contact Us” form that ReliaQuest calls “the cybercriminal equivalent of a cover letter”; others list only encrypted contacts, which “may serve as a pre-interview test, eliminating those greener applicants”. Applicants who get past that move to what the report describes as likely an anonymous interview, and rejection comes without feedback. LockBit skipped ads in favor of a 2,376-word affiliate rules page covering targeting and application procedure. On the Telegram side, Cyfirma notes recruiters seek “penetration testers or trusted partners” and sometimes demand forum reputation or a deposit before cooperating.Poaching after takedowns
Affiliate rosters reshuffle whenever enforcement lands. After LockBit's infrastructure seizure and ALPHV's exit scam in early 2024, BlackBasta collapsed in February 2025 after a chat-log leak, and RansomHub disbanded abruptly in late March 2025 - in Recorded Future's account, the disbandment “left victims mid-negotiation and affiliates in disarray”. The affiliates went somewhere: BlackBasta members were assessed to have moved to Akira, with whom they had prior ties; Group-IB assessed that some RansomHub affiliates joined Qilin, citing a spike in victim claims; DragonForce claimed to have absorbed RansomHub's infrastructure and affiliates under a “cartel” model that lets affiliates keep their own branding.“A new group replaces the one that has ceased to operate, and it often welcomes members of the defunct one.” - Kaspersky's Securelist on the malware-as-a-service market, 2023