Ransomware as a service (RaaS)

 

Ransomware as a service (RaaS) is the offering of pay-for-use malware. It is created for extortion over stolen or encrypted data, known as ransomware.

The author of the ransomware makes the software available to customers called affiliates, who use the software to hold people's data hostage with little technical skill. The use of RaaS enables affiliates to enter an area of extortion practices that was previously exclusive to the authors themselves.

For the malware author, this business model enables them to scale their earnings from their software with less personal risk than incurred if using it themselves. Offering their software to others removes them from the final crime by having another perform the act of ransom.

Like ransomware itself, RaaS is typically a criminal exercise that is almost always illegal anywhere around the world.

How does ransomware as a service work?

RaaS is all about providing ransomware in software as a service (SaaS) model. At the top of the organizational hierarchy is the RaaS operator. This is the group that develops the ransomware payload that encrypts user data.

The RaaS operator also operates all back-end infrastructures for running the ransomware campaign. That involves the ransomware code, a portal that enables potential customers to sign up and use the service and customer service to support campaigns. Full-service RaaS operators also handle the ransomware payments -- typically via a cryptocurrency such as Bitcoin -- and provide decryption keys to victims who pay the ransom. In addition, RaaS operators actively advertise their services on different underground forums across the dark web.

There are several different revenue and business models for RaaS. As a SaaS model, RaaS is offered to potential users on a monthly subscription basis, or as a one-time fee. Another common way that RaaS operators work is with an affiliate model. With the affiliate RaaS model, the RaaS operator takes a predetermined percentage of every ransom payout by victims who pay a ransom.

Ransomware vs. ransomware as a service

Ransomware is the actual malware payload that is used to encrypt the data of a victim's system. Once a system is infected with ransomware, a ransom demand is made to the victim to pay a ransom. If and when the victim pays the ransom, the attacker provides a decryption key to restore the encrypted data.

Ransomware is something that RaaS operators provide as a service. A single threat actor can develop their own ransomware code, but it is limited in reach.

RaaS expands the accessibility and potential reach of ransomware. Instead of a single group using ransomware code to attack victims, many groups of attackers can use RaaS to exploit victims with a ransomware infection.

How to prevent ransomware-as-a-service attacks

There are several best practices to help mitigate the risk of ransomware:

• Ensure data backup and recovery. The first and arguably most critical step is to have a data backup and recovery plan in place. Ransomware encrypts data, rendering it inaccessible to users. If an organization has up-to-date backups that can be used in a recovery operation, the effect of an attacker encrypting data can be reduced.
• Update software: ransomware often exploits known vulnerabilities in applications and operating systems. Updating software as patches and updates come out is necessary to help prevent ransomware attack.
• Multifactor authentication: Some ransomware attackers use credential stuffing where passwords stolen from one site are reused on another to access user accounts. Multifactor authentication reduces the effect of a single reused password, as a second factor is still needed to gain access.
• Phishing protection: A common attack vector for ransomware is email phishing. Having some form of anti-phishing email security in place can potentially prevent RaaS attacks.
• DNS filtering: Ransomware often communicates with a RaaS operator’s platform with some form of command and control (C2) server. Communication from an infected system to the C2 server almost always involves a DNS query. With a DNS filtering security service, it’s possible for organizations to identify when ransomware is attempting to communicate with the RaaS C2 and block the communications.
• XDR endpoint security: Another critical layer for ransomware protection is endpoint security and threat hunting technologies such as XDR. This provides extended detection and response capabilities that can limit ransomware risks.