Smaller RaaS groups are trying to recruit new and “displaced” LockBit and Alphv/BlackCat affiliates by foregoing deposits and paid subscriptions, offering better payout splits, 24/7 support, and other “perks”. Cybercriminals wanted RaaS operations usually consist of a core group that develops the ransomware and mantains the underlying infrastructure for its deployment, and affiliates that leverage it after breaking into target systems and networks and give the core group a percentage of the ransom as payment for their services.

Source: Help Net Security