What is Ransomware as a Service (RaaS)

By adopting the Software as a Service (SaaS) model, Ransomware as a Service (RaaS) makes cyber extortion accessible to a broad audience, not only to a traditional cybercriminal profile. This illegal business model creates an ecosystem where ransomware developers, or RaaS operators, lease or sell their ransomware tools to affiliates under various arrangements.

RaaS platforms often feature user-friendly interfaces, offering tools and services such as customizable ransomware variants, command and control (C&C) dashboards for tracking attacks, and victim payment portals. Also common are support services, including assistance with victim negotiations and access to dedicated leak sites for data extortion. RaaS operations are often marketed with a level of professionalism and customer support that matches legitimate SaaS offerings. Operators actively recruit affiliates through forums and even complex marketing campaigns.

The competitive nature of the RaaS market encourages continuous innovation among providers, who enhance their offerings with new features like victim-specific ransomware attributes, which complicate decryption efforts. This adaptability makes RaaS a persistent and evolving challenge within cybersecurity.

The RaaS framework includes several revenue models, appealing to a diverse range of possible customers:

• Monthly Subscription: Affiliates pay a recurring fee for access to the ransomware tools.
• Affiliate Programs: Similar to the subscription model but includes profit-sharing, a portion of the ransom collected (typically 20-30%) is paid to the ransomware developer.
• License Fee: Affiliates pay a single fee for perpetual access to the ransomware tools, with no obligation to share the profits.
• Pure Profit Sharing: This model involves no upfront costs for the affiliates. Instead, a significant percentage of each ransom payment (often 30-40%) is allocated to the RaaS operators.

RaaS attacks have evolved from the straightforward malware campaigns of the past into complex operations that exploit every available vulnerability. Below is a blueprint of how RaaS attacks are currently planned and executed. (Source)

• Initial Access: RaaS attacks still rely on phishing emails, unpatched vulnerabilities, or compromised credentials to access remote desktop protocols (RDP). Automated scalable attacks usually target smaller companies, while larger entities often face spear-phishing campaigns personalized to exploit system vulnerabilities.
• Staging: After a successful infiltration, attackers prepare the environment for the attack by escalating privileges and establishing persistent access. They might use specialized tools for setting the stage for extensive network compromise.
• Expansion: This phase involves reconnaissance and lateral movement across the network. Attackers use legitimate administrative tools and commands, a technique known as “Living off the Land”, to avoid detection while they map out the network and identify key assets.
• Extortion: With the groundwork laid, attackers focus on maximizing impact to pressure victims into paying the ransom. This might involve double or triple extortion tactics, where data is not just encrypted but also exfiltrated for potential public release, combined with other pressure tactics like DDoS attacks or harassment. Before deploying the ransomware payload, attackers often locate and destroy backups to weaken the victim’s position further.

RaaS attackers gain access to networks and systems through most common vectors that should be taken into consideration when deciding on the best defense strategy.

• Phishing Emails: Still a popular method, attackers use sophisticated social engineering methods to earn trust from the staff.
• Exploited Vulnerabilities: Unpatched software or insecurely configured services offer an easy access point for attackers.
• Malicious Downloads and URLs: Compromised or malicious websites can also serve as launchpads for ransomware.

Early detection of a ransomware attack is crucial in stopping its progress or at least in minimizing its impact. Below are the most common red flags signaling a potential RaaS attack.

Direct Indicators

• Changes in File Access: The sudden inability to access files or the discovery of encrypted files with ransom notes are among the most direct indicators of a ransomware attack.
• Altered File Extensions: Discovery of multiple files with strange extensions is often a clear sign of confirmed illegal encryption. For example, Locky ransomware was known for using extensions such as “.locky”, “.zzzzz”, and “.odin”.

Indirect Indicators

• Unusual Network and Disk Activity: High network traffic or odd connections might indicate data exfiltration, while increased disk activity without clear cause, particularly if it results in system slowdowns, can signal ongoing file encryption by ransomware.
• Account Irregularities: Observing multiple failed login attempts or access requests from unfamiliar locations could indicate compromised credentials, suggesting that attackers are trying to gain or expand access within your network.
• Security Alert Fatigue: An unusually high number of security alerts can overwhelm system administrators, potentially hiding real indicators of an attack among false positives.