Preventing ransomware-as-a-service attacks takes layered controls, continuous monitoring, and tested recovery. Ransomware-as-a-service rents prebuilt ransomware kits to low-skill affiliates who share profits with operators.
The FBI counted more than 3,600 ransomware complaints, over $32 million in losses, and 63 new variants in 2025. Those figures appear in the Industrial Cyber summary of the FBI report. This guide shows which controls, watches, and restores cut affiliate success.
Table of Contents
- Lock down the paths affiliates use first
- Harden remote access and patch exploited flaws
- Watch for behavior and rehearse response
- Restore from isolated backups
- Do not pay — report instead
Lock down the paths affiliates use first
Start with the controls CISA lists in its #StopRansomware Guide. They target email, remote access, and endpoints because affiliates use those first.
Phishing-resistant MFA needs a key or matching prompt, so a stolen password alone fails. Cover every account and device, including vendors and test systems. A single unprotected login or laptop can let an affiliate in.
- Require phishing-resistant MFA on remote and privileged accounts.
- Install EDR, endpoint detection and response, on all endpoints.
- Segment the network to limit movement between systems.
- Keep RDP off the internet and require VPN.
- Block macros and filter malicious email by default.
Harden remote access and patch exploited flaws
CISA warns that RDP and VPN misconfigurations invite initial access and lateral movement. RDP, Remote Desktop Protocol, lets a user control another computer remotely. Once inside, Akira-type affiliates use normal RDP to reach other machines.
CISA urges MFA and hardening for those entry points. Patch flaws listed in CISA's Known Exploited Vulnerabilities catalog without delay. Federal civilian agencies must meet BOD 22-01 due dates. CISA advises private owners to use the same catalog for priority.
Watch for behavior and rehearse response
NIST's ransomware profile calls for governed detection and response. Keep central logs, review anomalies, and act on EDR behavioral alerts.
EDR flags suspect behavior, such as mass file renaming or disabled defenses. Keep an incident-response plan with law-enforcement and counsel contacts. Exercise the plan so staff know roles, call trees, and shutdown steps.
Restore from isolated backups
CISA directs organizations to keep offline, encrypted backups and test restoration. Keep offline network documents and hard copies to rebuild without paying.
NIST prescribes restoring from the last known-good isolated backup after integrity testing, in the NIST recovery guide SP 1800-11. Set RTO and RPO targets that match what the business can lose. Do not reconnect systems until the clean restore is verified.
- Isolate and inspect a known-good copy before use.
- Test files for corruption and integrity.
- Rebuild to a clean system, not decrypt in place.
- Track RTO, recovery time objective, and RPO, recovery point objective.
- Run restore tests quarterly.
Do not pay — report instead
The FBI and CISA strongly discourage paying ransom. Payment does not guarantee file recovery or data deletion and funds further crime.
Payment may violate sanctions. Medusa cases included a second demand after payment, as noted on the FBI ransomware page. Report to IC3 and CISA instead of paying.
You Might Also Like
- Cybersecurity — Extortion Demand Prevention Guide: Controls, Monitoring, and Recovery
- Ascension Ransomware Prevention Guide: Controls, Monitoring, and Recovery
- Leak Site Ransomware Investigation Guide: Evidence, Notices, and Verification