Ransomware-as-a-Service offerings have largely shifted over the past five or six years to take a more crowdsourced, profit-sharing approach. Many RaaS affiliates, instead of paying a premium to subscribe, agree to split the proceeds of any ransom that gets paid by a victim. This often includes a self-service payment portal for victims to pay their ransom – almost always in bitcoin, but sometimes monero or another more privacy-preserving digital currency – and accompanying “customer support” operations.”]
Source: https://www.cuinfosecurity.com/more-ransomware-as-a-service-operations-seek-affiliates-a-15378