Browse Definitions :
4 types of ransomware and a timeline of attack examples WannaCry ransomware
Definition

ransomware as a service (RaaS)

What is ransomware as a service (RaaS)?

Ransomware as a service (RaaS) is the offering of pay-for-use malware. It is created for extortion over stolen or encrypted data, known as ransomware.

The author of the ransomware makes the software available to customers called affiliates, who use the software to hold people's data hostage with little technical skill. The use of RaaS enables affiliates to enter an area of extortion practices that was previously exclusive to the authors themselves.

For the malware author, this business model enables them to scale their earnings from their software with less personal risk than incurred if using it themselves. Offering their software to others removes them from the final crime by having another perform the act of ransom.

Like ransomware itself, RaaS is typically a criminal exercise that is almost always illegal anywhere around the world.

How does ransomware as a service work?

RaaS is all about providing ransomware in a software as a service (SaaS) model. At the top of the organizational hierarchy is the RaaS operator. This is the group that develops the ransomware payload that encrypts user data.

The RaaS operator also operates all back-end infrastructure for running the ransomware campaign. That involves the ransomware code, a portal that enables potential customers to sign up and use the service and customer service to support campaigns. Full-service RaaS operators also handle the ransomware payments -- typically via a cryptocurrency such as Bitcoin -- and provide decryption keys to victims who pay the ransom. In addition, RaaS operators actively advertise their services on different underground forums across the dark web.

There are several different revenue and business models for RaaS. As a SaaS model, RaaS is offered to potential users on a monthly subscription basis, or as a one-time fee. Another common way that RaaS operators work is with an affiliate model. With the affiliate RaaS model, the RaaS operator takes a predetermined percentage of every ransom payout by victims who pay a ransom.

Learn about the differences between cryptocurrency, digital currency and NFTs here.

Ransomware vs. ransomware as a service

Ransomware is the actual malware payload that is used to encrypt the data of a victim's system. Once a system is infected with ransomware, a ransom demand is made to the victim to pay a ransom. If and when the victim pays the ransom, the attacker provides a decryption key to restore the encrypted data.

Ransomware is something that RaaS operators provide as a service. A single threat actor can develop their own ransomware code, but it is limited in reach.

RaaS expands the accessibility and potential reach of ransomware. Instead of a single group using ransomware code to attack victims, many groups of attackers can use RaaS to exploit victims with a ransomware infection.

Examples of ransomware as a service

In recent years, ransomware authors have discovered the lucrative nature of running an RaaS operation. And there has been no shortage of threat actor groups building out RaaS operations to spread ransomware across nearly every industry. Here are some of those RaaS providers:

  • DarkSide. Among the most notorious RaaS operators is DarkSide. This group is reported to be responsible for the Colonial Pipeline attack In May 2021. DarkSide is thought to have got its start in August 2020 and was particularly active in the first few months of 2021.
  • Dharma. Dharma Ransomware first emerged in 2016 and was initially known as CrySis. Over the years there have been many Dharma Ransomware variants, but it was in 2020 that Dharma emerged in a RaaS model.
  • DoppelPaymer. DoppelPaymer has been linked to several incidents -- including one against a hospital in Germany in 2020 that resulted in the death of a patient.
  • LockBit. LockBit first emerged in September 2019 as the ".abcd virus," which was the file extension the group uses to encrypt victim files. Among the attributes of LockBit is its ability to automatically self-propagate in a target network. This makes it an attractive RaaS for would-be attackers.
  • Maze. Like many other RaaS operators, Maze made its appearance in 2019. Beyond just encrypting user data, the RaaS group also attempted to shame victims by threatening to share data publicly. For reasons that remain somewhat unclear, the Maze RaaS officially shut down in November 2020. However, some researchers think the same criminals have continued under a different name, such as Egregor.
  • REvil. While there are multiple RaaS operators, none have been as pervasive in 2021 as REvil. The REvil RaaS was implicated in the Kaseya attack, which affected at least 1,500 organizations in July 2021. The group was also allegedly responsible for an attack on meat producer JBS USA in June 2021, in which the victim paid an $11 million ransom. In March 2021, REvil was also identified as being behind a ransomware attack on cyber insurance carrier CNA Financial.
  • Ryuk. Ryuk is thought to have been active since at least 2017, though the RaaS was more active in 2019. Some researchers alleged the group was based in North Korea, which has been refuted by multiple security firms, including CrowdStrike and FireEye.

How to prevent ransomware-as-a-service attacks

There are several best practices to help mitigate the risk of ransomware:

  • Ensure data backup and recovery. The first and arguably most critical step is to have a data backup and recovery plan in place. Ransomware encrypts data, rendering it inaccessible to users. If an organization has up-to-date backups that can be used in a recovery operation, the effect of an attacker encrypting data can be reduced.
  • Update software. Ransomware often exploits known vulnerabilities in applications and operating systems. Updating software as patches and updates come out is necessary to help prevent ransomware attacks.
  • Multifactor authentication. Some ransomware attackers use credential stuffing -- where passwords stolen from one site are reused on another -- to access user accounts. Multifactor authentication reduces the effect of a single reused password, as a second factor is still needed to gain access.
  • Phishing protection. A common attack vector for ransomware is email phishing Having some form of anti-phishing email security in place can potentially prevent RaaS attacks.
  • DNS filtering. Ransomware often communicates with a RaaS operator's platform with some form of command and control (C2) server. Communications from an infected system to the C2 server almost always involves a DNS query. With a DNS filtering security service, it's possible for organizations to identify when ransomware is attempting to communicate with the RaaS C2 and block the communications. This can serve as a form of protection against infection.
  • XDR endpoint security. Another critical layer for ransomware protection is endpoint security and threat hunting technologies -- such as XDR. This provides extended detection and response capabilities that can limit ransomware risks.
This was last updated in July 2021

Continue Reading About ransomware as a service (RaaS)

SearchNetworking
  • network packet

    A network packet is a basic unit of data that's grouped together and transferred over a computer network, typically a ...

  • virtual network functions (VNFs)

    Virtual network functions (VNFs) are virtualized tasks formerly carried out by proprietary, dedicated hardware.

  • network functions virtualization (NFV)

    Network functions virtualization (NFV) is a network architecture model designed to virtualize network services that have ...

SearchSecurity
  • Domain-based Message Authentication, Reporting and Conformance (DMARC)

    The Domain-based Message Authentication, Reporting and Conformance (DMARC) protocol is one leg of the tripod of internet ...

  • data breach

    A data breach is a cyber attack in which sensitive, confidential or otherwise protected data has been accessed or disclosed in an...

  • insider threat

    An insider threat is a category of risk posed by those who have access to an organization's physical or digital assets.

SearchCIO
  • data privacy (information privacy)

    Data privacy, also called information privacy, is an aspect of data protection that addresses the proper storage, access, ...

  • leadership skills

    Leadership skills are the strengths and abilities individuals demonstrate that help to oversee processes, guide initiatives and ...

  • data governance policy

    A data governance policy is a documented set of guidelines for ensuring that an organization's data and information assets are ...

SearchHRSoftware
SearchCustomerExperience
  • recommerce

    Recommerce is the selling of previously owned items through online marketplaces to buyers who reuse, recycle or resell them.

  • implementation

    Implementation is the execution or practice of a plan, a method or any design, idea, model, specification, standard or policy for...

  • first call resolution (FCR)

    First call resolution (FCR) is when customer service agents properly address a customer's needs the first time they call.

Close