Cyber Threat Actor: RaaS Affiliate

The threat actor identified by the alias RaaS Affiliate is known to operate from Germany, as indicated in open‑source reporting. The alias itself signals that the individual or group functions as an affiliate within a ransomware‑as‑a‑service (RaaS) framework, leveraging infrastructure provided by a central ransomware operator. Publicly available sources associate this affiliate with the legal services sector, specifically noting targeting of law firms located in Germany. The actor’s observed objective is financial gain, pursued through extortion tactics that involve encrypting victim data and demanding payment for decryption keys. No evidence of state sponsorship, ideological motives, or espionage goals has been presented in the attributed incidents or related threat intelligence.

On 3 February 2023 the RaaS Affiliate carried out a ransomware attack against Kapellmann und Partner Rechtsanwälte mbB, a German law firm with multiple office locations. The ransomware payload encrypted the firm’s internal IT systems across all sites, rendering files inaccessible while the public‑facing website and telephone services continued to function without interruption. As a consequence of the encryption, the firm’s internal email system was disrupted, prompting the organization to advise clients and staff to use landline phones, mobile devices, or a secure legal electronic mailbox for transmitting urgent documents. The attack was explicitly described as an extortion attempt, with the threat actors communicating a demand for payment in exchange for the restoration of access to the encrypted data. In response, Kapellmann und Partner engaged external cybersecurity specialists and coordinated with law‑enforcement agencies to conduct forensic analysis, implement containment measures, and begin the process of restoring data from backups. Throughout the incident response, the firm issued public apologies for the inconvenience caused and committed to providing regular updates on recovery progress via its homepage and official social‑media channels. This event serves as a concrete illustration of the actor’s typical operational pattern, demonstrating the use of ransomware to target professional‑service entities in Germany for the purpose of financial extortion. The incident highlights the continued relevance of ransomware affiliates in exploiting sector‑specific vulnerabilities to achieve monetary objectives.