Browse Definitions :
4 types of ransomware and a timeline of attack examples WannaCry ransomware
Definition

ransomware as a service (RaaS)

What is ransomware as a service (RaaS)?

Ransomware as a service (RaaS) is the offering of pay-for-use malware. It is created for extortion over stolen or encrypted data, known as ransomware.

The author of the ransomware makes the software available to customers called affiliates, who use the software to hold people's data hostage with little technical skill. The use of RaaS enables affiliates to enter an area of extortion practices that was previously exclusive to the authors themselves.

For the malware author, this business model enables them to scale their earnings from their software with less personal risk than incurred if using it themselves. Offering their software to others removes them from the final crime by having another perform the act of ransom.

Like ransomware itself, RaaS is typically a criminal exercise that is almost always illegal anywhere around the world.

How does ransomware as a service work?

RaaS is all about providing ransomware in a software as a service (SaaS) model. At the top of the organizational hierarchy is the RaaS operator. This is the group that develops the ransomware payload that encrypts user data.

The RaaS operator also operates all back-end infrastructure for running the ransomware campaign. That involves the ransomware code, a portal that enables potential customers to sign up and use the service and customer service to support campaigns. Full-service RaaS operators also handle the ransomware payments -- typically via a cryptocurrency such as Bitcoin -- and provide decryption keys to victims who pay the ransom. In addition, RaaS operators actively advertise their services on different underground forums across the dark web.

There are several different revenue and business models for RaaS. As a SaaS model, RaaS is offered to potential users on a monthly subscription basis, or as a one-time fee. Another common way that RaaS operators work is with an affiliate model. With the affiliate RaaS model, the RaaS operator takes a predetermined percentage of every ransom payout by victims who pay a ransom.

Learn about the differences between cryptocurrency, digital currency and NFTs here.

Ransomware vs. ransomware as a service

Ransomware is the actual malware payload that is used to encrypt the data of a victim's system. Once a system is infected with ransomware, a ransom demand is made to the victim to pay a ransom. If and when the victim pays the ransom, the attacker provides a decryption key to restore the encrypted data.

Ransomware is something that RaaS operators provide as a service. A single threat actor can develop their own ransomware code, but it is limited in reach.

RaaS expands the accessibility and potential reach of ransomware. Instead of a single group using ransomware code to attack victims, many groups of attackers can use RaaS to exploit victims with a ransomware infection.

Examples of ransomware as a service

In recent years, ransomware authors have discovered the lucrative nature of running an RaaS operation. And there has been no shortage of threat actor groups building out RaaS operations to spread ransomware across nearly every industry. Here are some of those RaaS providers:

  • DarkSide. Among the most notorious RaaS operators is DarkSide. This group is reported to be responsible for the Colonial Pipeline attack In May 2021. DarkSide is thought to have got its start in August 2020 and was particularly active in the first few months of 2021.
  • Dharma. Dharma Ransomware first emerged in 2016 and was initially known as CrySis. Over the years there have been many Dharma Ransomware variants, but it was in 2020 that Dharma emerged in a RaaS model.
  • DoppelPaymer. DoppelPaymer has been linked to several incidents -- including one against a hospital in Germany in 2020 that resulted in the death of a patient.
  • LockBit. LockBit first emerged in September 2019 as the ".abcd virus," which was the file extension the group uses to encrypt victim files. Among the attributes of LockBit is its ability to automatically self-propagate in a target network. This makes it an attractive RaaS for would-be attackers.
  • Maze. Like many other RaaS operators, Maze made its appearance in 2019. Beyond just encrypting user data, the RaaS group also attempted to shame victims by threatening to share data publicly. For reasons that remain somewhat unclear, the Maze RaaS officially shut down in November 2020. However, some researchers think the same criminals have continued under a different name, such as Egregor.
  • REvil. While there are multiple RaaS operators, none have been as pervasive in 2021 as REvil. The REvil RaaS was implicated in the Kaseya attack, which affected at least 1,500 organizations in July 2021. The group was also allegedly responsible for an attack on meat producer JBS USA in June 2021, in which the victim paid an $11 million ransom. In March 2021, REvil was also identified as being behind a ransomware attack on cyber insurance carrier CNA Financial.
  • Ryuk. Ryuk is thought to have been active since at least 2017, though the RaaS was more active in 2019. Some researchers alleged the group was based in North Korea, which has been refuted by multiple security firms, including CrowdStrike and FireEye.

How to prevent ransomware-as-a-service attacks

There are several best practices to help mitigate the risk of ransomware:

  • Ensure data backup and recovery. The first and arguably most critical step is to have a data backup and recovery plan in place. Ransomware encrypts data, rendering it inaccessible to users. If an organization has up-to-date backups that can be used in a recovery operation, the effect of an attacker encrypting data can be reduced.
  • Update software. Ransomware often exploits known vulnerabilities in applications and operating systems. Updating software as patches and updates come out is necessary to help prevent ransomware attacks.
  • Multifactor authentication. Some ransomware attackers use credential stuffing -- where passwords stolen from one site are reused on another -- to access user accounts. Multifactor authentication reduces the effect of a single reused password, as a second factor is still needed to gain access.
  • Phishing protection. A common attack vector for ransomware is email phishing Having some form of anti-phishing email security in place can potentially prevent RaaS attacks.
  • DNS filtering. Ransomware often communicates with a RaaS operator's platform with some form of command and control (C2) server. Communications from an infected system to the C2 server almost always involves a DNS query. With a DNS filtering security service, it's possible for organizations to identify when ransomware is attempting to communicate with the RaaS C2 and block the communications. This can serve as a form of protection against infection.
  • XDR endpoint security. Another critical layer for ransomware protection is endpoint security and threat hunting technologies -- such as XDR. This provides extended detection and response capabilities that can limit ransomware risks.
This was last updated in July 2021

Continue Reading About ransomware as a service (RaaS)

Networking
  • CSU/DSU (Channel Service Unit/Data Service Unit)

    A CSU/DSU (Channel Service Unit/Data Service Unit) is a hardware device about the size of a modem. It converts a digital data ...

  • data streaming

    Data streaming is the continuous transfer of data from one or more sources at a steady, high speed for processing into specific ...

  • secure access service edge (SASE)

    Secure access service edge, also known as SASE and pronounced sassy, is a cloud architecture model that bundles network and ...

Security
  • application blacklisting (application blocklisting)

    Application blacklisting --increasingly called application blocklisting -- is a network or computer administration practice used ...

  • juice jacking

    Juice jacking is a security exploit in which an infected USB charging station is used to compromise devices that connect to it.

  • hypervisor security

    Hypervisor security is the process of ensuring the hypervisor -- the software that enables virtualization -- is secure throughout...

CIO
HRSoftware
  • recruitment process outsourcing (RPO)

    Recruitment process outsourcing (RPO) is when an employer turns the responsibility of finding potential job candidates over to a ...

  • human resources (HR) generalist

    A human resources generalist is an HR professional who handles the daily responsibilities of talent management, employee ...

  • employee lifecycle

    The employee lifecycle is a human resources model that identifies the different stages a worker advances through in an ...

Customer Experience
  • Adobe Experience Platform

    Adobe Experience Platform is a suite of customer experience management (CXM) solutions from Adobe.

  • virtual assistant (AI assistant)

    A virtual assistant, also called an AI assistant or digital assistant, is an application program that understands natural ...

  • inbound marketing

    Inbound marketing is a strategy that focuses on attracting customers, or leads, via company-created internet content, thereby ...

Close