ransomware as a service (RaaS)

What is ransomware as a service (RaaS)?

Ransomware as a service (RaaS) is the offering of pay-for-use malware. It is created for extortion over stolen or encrypted data, known as ransomware.

The author of the ransomware makes the software available to customers called affiliates, who use the software to hold people's data hostage with little technical skill. The use of RaaS enables affiliates to enter an area of extortion practices that was previously exclusive to the authors themselves.

For the malware author, this business model enables them to scale their earnings from their software with less personal risk than incurred if using it themselves. Offering their software to others removes them from the final crime by having another perform the act of ransom.

Like ransomware itself, RaaS is typically a criminal exercise that is almost always illegal anywhere around the world.

How does ransomware as a service work?

RaaS is all about providing ransomware in a software as a service (SaaS) model. At the top of the organizational hierarchy is the RaaS operator. This is the group that develops the ransomware payload that encrypts user data.

The RaaS operator also operates all back-end infrastructure for running the ransomware campaign. That involves the ransomware code, a portal that enables potential customers to sign up and use the service and customer service to support campaigns. Full-service RaaS operators also handle the ransomware payments -- typically via a cryptocurrency such as Bitcoin -- and provide decryption keys to victims who pay the ransom. In addition, RaaS operators actively advertise their services on different underground forums across the dark web.

There are several different revenue and business models for RaaS. As a SaaS model, RaaS is offered to potential users on a monthly subscription basis, or as a one-time fee. Another common way that RaaS operators work is with an affiliate model. With the affiliate RaaS model, the RaaS operator takes a predetermined percentage of every ransom payout by victims who pay a ransom.

Learn about the differences between cryptocurrency, digital currency and NFTs here.

Ransomware vs. ransomware as a service

Ransomware is the actual malware payload that is used to encrypt the data of a victim's system. Once a system is infected with ransomware, a ransom demand is made to the victim to pay a ransom. If and when the victim pays the ransom, the attacker provides a decryption key to restore the encrypted data.

Ransomware is something that RaaS operators provide as a service. A single threat actor can develop their own ransomware code, but it is limited in reach.

RaaS expands the accessibility and potential reach of ransomware. Instead of a single group using ransomware code to attack victims, many groups of attackers can use RaaS to exploit victims with a ransomware infection.

Examples of ransomware as a service

In recent years, ransomware authors have discovered the lucrative nature of running an RaaS operation. And there has been no shortage of threat actor groups building out RaaS operations to spread ransomware across nearly every industry. Here are some of those RaaS providers:

• DarkSide. Among the most notorious RaaS operators is DarkSide. This group is reported to be responsible for the Colonial Pipeline attack In May 2021. DarkSide is thought to have got its start in August 2020 and was particularly active in the first few months of 2021.
• Dharma. Dharma Ransomware first emerged in 2016 and was initially known as CrySis. Over the years there have been many Dharma Ransomware variants, but it was in 2020 that Dharma emerged in a RaaS model.
• DoppelPaymer. DoppelPaymer has been linked to several incidents -- including one against a hospital in Germany in 2020 that resulted in the death of a patient.
• LockBit. LockBit first emerged in September 2019 as the ".abcd virus," which was the file extension the group uses to encrypt victim files. Among the attributes of LockBit is its ability to automatically self-propagate in a target network. This makes it an attractive RaaS for would-be attackers.
• Maze. Like many other RaaS operators, Maze made its appearance in 2019. Beyond just encrypting user data, the RaaS group also attempted to shame victims by threatening to share data publicly. For reasons that remain somewhat unclear, the Maze RaaS officially shut down in November 2020. However, some researchers think the same criminals have continued under a different name, such as Egregor.
• REvil. While there are multiple RaaS operators, none have been as pervasive in 2021 as REvil. The REvil RaaS was implicated in the Kaseya attack, which affected at least 1,500 organizations in July 2021. The group was also allegedly responsible for an attack on meat producer JBS USA in June 2021, in which the victim paid an $11 million ransom. In March 2021, REvil was also identified as being behind a ransomware attack on cyber insurance carrier CNA Financial.
• Ryuk. Ryuk is thought to have been active since at least 2017, though the RaaS was more active in 2019. Some researchers alleged the group was based in North Korea, which has been refuted by multiple security firms, including CrowdStrike and FireEye.

How to prevent ransomware-as-a-service attacks

There are several best practices to help mitigate the risk of ransomware:

• Ensure data backup and recovery. The first and arguably most critical step is to have a data backup and recovery plan in place. Ransomware encrypts data, rendering it inaccessible to users. If an organization has up-to-date backups that can be used in a recovery operation, the effect of an attacker encrypting data can be reduced.
• Update software. Ransomware often exploits known vulnerabilities in applications and operating systems. Updating software as patches and updates come out is necessary to help prevent ransomware attacks.
• Multifactor authentication. Some ransomware attackers use credential stuffing -- where passwords stolen from one site are reused on another -- to access user accounts. Multifactor authentication reduces the effect of a single reused password, as a second factor is still needed to gain access.
• Phishing protection. A common attack vector for ransomware is email phishing Having some form of anti-phishing email security in place can potentially prevent RaaS attacks.
• DNS filtering. Ransomware often communicates with a RaaS operator's platform with some form of command and control (C2) server. Communications from an infected system to the C2 server almost always involves a DNS query. With a DNS filtering security service, it's possible for organizations to identify when ransomware is attempting to communicate with the RaaS C2 and block the communications. This can serve as a form of protection against infection.
• XDR endpoint security. Another critical layer for ransomware protection is endpoint security and threat hunting technologies -- such as XDR. This provides extended detection and response capabilities that can limit ransomware risks.