The RaaS model functions through a preexisting network of cybercriminal actors. Distributors will develop the malware to work as destructively as possible and then pass off this software to “affiliates.” These affiliates will then perform the actual ransomware attack.
Usually, the affiliates gain access to the malware through subscription-based services which involve a monthly cut for distributors and affiliates, or they purchase a one-time license from the developers, similar to how many commercial software platforms function.
The benefit of this model is that tracing the source of the malware and tracking the cybercriminal attackers becomes a twofold task. Even if you find the affiliates, their trail doesn’t necessarily lead to the developers of the software, and vice-versa.