ransomware as a service (RaaS)

What is ransomware as a service (RaaS)?

Ransomware as a service (RaaS) is a subscription-based business model that enables affiliates to launch ransomware attacks by accessing and using pre-developed ransomware tools.

The author of the ransomware makes the software or pay-for-use malware available to its affiliates -- customers with little technical skill -- who use the software to hold people's data hostage. The use of RaaS lets affiliates receive a percentage of each successful ransom payment, entering an area of extortion practices previously exclusive to ransomware authors or experienced hackers.

This business model lets the malware author scale earnings from their software, incurring less personal risk than if using it themselves. Offering their software to others removes the malware author from the final crime by having another person perform the actual act of ransom.

Both ransomware and RaaS are criminal exercises that are almost always illegal anywhere around the world.

How does ransomware as a service work?

RaaS is all about providing ransomware in a software as a service (SaaS) model. At the top of the organizational hierarchy is the RaaS operator. This is the group that develops the ransomware payload that encrypts user data.

The ransomware operator also manages all back-end infrastructure to run the ransomware campaign. This involves the ransomware code, a portal that enables potential customers to sign up and use the service and customer service to support campaigns. Full-service RaaS operators also handle ransomware payments -- typically via a cryptocurrency such as Bitcoin -- and provide decryption keys to victims who pay the ransom. In addition, RaaS operators actively advertise their services on different underground forums across the dark web.

Learn about the differences between cryptocurrency, digital currency and NFTs here.

What is the RaaS Model?

There are several different business and revenue models for RaaS, including the following:

• Monthly subscription. As a SaaS model, RaaS is offered to potential users on a monthly subscription basis. Users pay a monthly flat fee and receive a small percentage of each successful ransom.
• One-time license fee. The RaaS model is offered to users for a one-time fee. After users make a one-time payment, they gain indefinite access to services and don't have to share profits with the RaaS operators.
• Affiliate programs. An affiliate model has the underlying goal of increasing profits. The RaaS operator takes a predetermined percentage of every ransom payout made by victims.
• Pure profit sharing. In this business model, once the affiliate purchases a license, profits are split among users and operators according to predetermined percentages.

Ransomware vs. ransomware as a service

Ransomware is the actual malware payload that's used to encrypt the data of a victim's system. Once a system is infected with ransomware, a ransom demand is made to the victim to pay a ransom. If and when the victim pays the ransom, the attacker provides a decryption key to restore the encrypted data.

Ransomware is something that ransomware developers provide as a service to subscribers who pay to be an affiliate of the program. A single threat actor can develop their own ransomware code, but it's limited in reach.

RaaS expands the accessibility and potential reach of ransomware. Instead of a single group using ransomware code to attack victims, many groups of attackers can use RaaS to exploit victims with a ransomware infection.

Examples of ransomware as a service

In recent years, ransomware authors have discovered the lucrative nature of running a RaaS operation. And there hasn't been any shortage of threat actor groups building out RaaS operations to spread ransomware across nearly every industry.

The following are some RaaS providers:

• DarkSide. Among the most notorious RaaS operators, this group is reported to be responsible for the Colonial Pipeline attack in May 2021. DarkSide is thought to have got its start in August 2020 and was particularly active in the first few months of 2021.
• Dharma. Dharma Ransomware first emerged in 2016 and was initially known as CrySis. Over the years, there have been many Dharma Ransomware variants, but in 2020, Dharma emerged in a RaaS model.
• DoppelPaymer. DoppelPaymer has been linked to several incidents -- including one against a hospital in Germany in 2020 that resulted in the death of a patient.
• LockBit. LockBit first emerged in September 2019 as the ".abcd virus," which is the file extension the group uses to encrypt victim's files. Among the attributes of LockBit is its ability to automatically self-propagate in a target network. This makes it an attractive RaaS for would-be attackers.
• Maze. Like many other RaaS operators, Maze made its appearance in 2019. Beyond just encrypting user data, the RaaS group also attempted to shame victims by threatening to share data publicly. For reasons that remain somewhat unclear, the Maze RaaS officially shut down in November 2020. However, some researchers think the same cybercriminals have continued under a different name, such as Egregor.
• REvil. While there are multiple RaaS operators, none have been as pervasive as REvil. The REvil RaaS was implicated in the Kaseya attack, which affected at least 1,500 organizations in July 2021. The group was also allegedly responsible for an attack on meat producer JBS USA in June 2021, in which the victim paid an $11 million ransom. In March 2021, REvil was also identified as being behind a ransomware attack on cyber insurance carrier CNA Financial.
• Ryuk. Ryuk is thought to have been active since at least 2017, though the RaaS was more active in 2019. Some researchers alleged the group was based in North Korea, which has been refuted by multiple security firms, including CrowdStrike and FireEye.
• RTM Locker. Read the Manual (RTM) Locker is an emerging Raas provider that was first documented back in 2015 as banking malware. It has since evolved as a RaaS provider and is known to offer a standard affiliate-based business model. RTM affiliates are given a web interface to control their cybercrime operations along with a thorough explanation of the group's guidelines, goals and suggested offensive strategies.

How to prevent ransomware-as-a-service attacks

The following are some best practices to help mitigate the risk of ransomware.

• Ensure data backup and recovery. The first and arguably most critical step is to have a data backup and recovery plan in place. Ransomware encrypts data, rendering it inaccessible to users. If an organization has up-to-date backups that can be used in a recovery operation, this can reduce the effect of an attacker encrypting data.
• Update software. Ransomware often exploits known vulnerabilities in applications and operating systems. Updating software as patches and updates come out is necessary to help prevent ransomware and other cyber attacks.
• Use multifactor authentication. Some ransomware attackers use credential stuffing -- where passwords stolen from one site are reused on another -- to access user accounts. Multifactor authentication reduces the effect of a single reused password, as a second factor is still needed to gain access.
• Implement phishing protection. A common attack vector for ransomware is email phishing. Having some form of anti-phishing email security in place can potentially prevent RaaS attacks.
• Use DNS filtering. Ransomware often communicates with a RaaS operator's platform using some form of command and control (C2) server. Communications from an infected system to the C2 server almost always involves a domain name system (DNS) query. With a DNS filtering security service, it's possible for organizations to identify when ransomware is attempting to communicate with the RaaS C2 and block the communications. This can serve as a form of protection against infection.
• Implement XDR endpoint security. Another critical layer for ransomware protection is endpoint protection and threat hunting technologies -- such as XDR and antivirus software. This provides extended detection and response capabilities that can limit ransomware risks.
• Manage third-party security. To avoid third-party breaches, businesses must keep an eye on the security practices of all of their vendors.
• Restrict access. To avert security issues, companies should limit administrative and system access to people who genuinely require it.
• Educate staff. For companies, regularly training their employees on cybersecurity best practices and social engineering tactics can be an effective way to prevent RaaS attacks and cyber threats in general.

The future of RaaS

The frequency of targeted ransomware attacks is increasing as the adoption of RaaS services grows. Ransomware accounted for approximately 20% of cybercrimes in 2022. The cybersecurity threat landscape constantly witnesses the emergence of new ransomware variants, placing pressure on security teams to respond by enforcing patching programs and quickly addressing known vulnerabilities.

On the flip side, there have been reports of ransomware gangs facing increased scrutiny and arrests by governments. A notable example is the U.S. Department of Justice's seizure of $6 million from REvil.

While it's difficult to determine the future trajectory of RaaS attacks with certainty, it's important for companies to proactively adopt measures to mitigate potential RaaS attacks.

Organizations across various industries face the risk of becoming targets of financially motivated cybercrime. Explore this guide and gain valuable insights from experts on how to effectively detect, mitigate and recover from ransomware attacks.