Ransomware-as-a-Service (RaaS): Fueling the Rise of Cyber Extortion

Introduction:

In the evolving landscape of cybercrime, one phenomenon that has gained significant attention and concern is Ransomware as a Service (RaaS). RaaS has revolutionized the cybercriminal ecosystem, enabling even the most inexperienced individuals to unleash devastating ransomware attacks. This article delves deeper into the workings of RaaS, its impact on individuals and organizations, and the urgent need for proactive measures to counter this growing threat.

Ransomware as a Service (RaaS) is a cybercriminal business model in which threat actors or hackers develop and distribute ransomware to other malicious actors, who then use the ransomware to carry out attacks. In this model, the ransomware developers act as service providers, offering their malware to other individuals or groups in exchange for a cut of the ransom payments.

The Rise of Ransomware as a Service:

Ransomware attacks are increasingly prevalent and sophisticated, resulting in substantial financial losses and operational disruptions for victims. RaaS has played a pivotal role in the proliferation of ransomware attacks by lowering the barrier to entry. In the past, only skilled cybercriminals had the expertise to develop and distribute ransomware. RaaS has now commoditized ransomware, making it readily accessible to a wider range of criminals, even those with a lower skillset.

Some key aspects of Ransomware as a Service:

Availability: RaaS makes sophisticated ransomware readily available to less technically skilled cybercriminals. This lowers the barrier to entry for carrying out ransomware attacks, as aspiring attackers can simply acquire pre-developed ransomware from RaaS providers.

Customization:RaaS providers offer customization options for the ransomware. This allows users to modify certain features of the malware, such as the ransom note, encryption methods, or target selection, to suit their specific attack objectives.

Revenue Sharing:RaaS providers typically implement revenue-sharing models, where they receive a percentage of the ransom payments made by the victims. This creates an incentive for both the ransomware developers and the attackers to collaborate and maximize their financial gains.

Support and Infrastructure:RaaS providers may offer technical support, hosting services, and infrastructure to their customers. This includes providing command-and-control (C&C) servers, payment portals, and communication channels to facilitate the interaction between the attackers and the victims during the ransomware attacks.

Criminal Ecosystems:RaaS contributes to the development of criminal ecosystems by connecting ransomware developers, distributors, and attackers. This collaborative model allows cybercriminals with varying skill sets to collaborate, share resources, and profit from ransomware attacks collectively.

Escalation of Attacks:RaaS has contributed to the widespread proliferation and evolution of ransomware attacks. It has enabled the rapid development and distribution of new ransomware variants, leading to an increase in the frequency and sophistication of attacks globally.

Affiliate Programs: Some RaaS platforms operate affiliate programs, where individuals or groups can sign up to become affiliates. Affiliates receive a portion of the ransom payments or earn referral fees for bringing new customers to the RaaS platform. This incentivizes more individuals to participate in the distribution and use of ransomware.

Monetization Model:RaaS providers often offer different pricing models to their customers, such as one-time fees, subscription-based plans, or revenue sharing based on the ransom payments. This flexibility allows attackers to choose the payment structure that aligns with their preferences and potential earnings.

Exploit Kits Integration:RaaS can be integrated with exploit kits, which are toolsets used to exploit software vulnerabilities and deliver malware. This integration enhances the capabilities of the ransomware, allowing it to spread more efficiently and target a larger number of potential victims.

Common RaaS Models:

1. Monthly subscription for a flat fee.
2. Affiliate programs, which are the same as a monthly fee model but with a percent of the profits (typically 20-30%) going to the ransomware developer.
3. One-time license fee with no profit sharing.
4. Pure profit sharing.

Implications and Impact: The widespread availability of RaaS has resulted in a surge of ransomware attacks, affecting individuals, businesses, healthcare organizations, and even critical infrastructure providers. The financial impact is staggering, with victims often left with no choice but to pay exorbitant ransoms to regain access to their encrypted data. The collateral damage caused by these attacks includes reputational harm, legal repercussions, and the erosion of public trust in digital systems.

Examples of RaaS:

Hive: Hive is a RaaS group that became popular in April 2022 when they targeted a large number of Microsoft’s Exchange Server customers using a pass-the-hash technique. Organizations included financial firms, non-profits, healthcare organizations, among many more. On January 26, 2023, the United States Department of Justice announced they had disrupted Hive operations by seizing two back-end servers belonging to the group in Los Angeles, CA. It is estimated that Hive left behind over 1,500 victims worldwide and extorted millions of dollars in ransom payments.

DarkSide:DarkSide is a RaaS operation associated with an eCrime group tracked by CrowdStrike as CARBON SPIDER. DarkSide operators traditionally focused on Windows machines and have recently expanded to Linux, targeting enterprise environments running unpatched VMware ESXi hypervisors or stealing vCenter credentials. On May 10, the FBI publicly indicated that the Colonial Pipeline incident involved the DarkSideransomware. It was later reported that Colonial Pipeline had approximately 100GB of data stolen from their network, and the organization allegedly paid almost $5 million USD to a DarkSide affiliate.

REvil:REvil, also known as Sodinokibi, was identified as the ransomware behind one of the largest ransom demands on record: $10 million. It is sold by the criminal group PINCHY SPIDER, which sells RaaS under the affiliate model and typically takes 40% of the profits.

Like TWISTED SPIDER’s initial leaks, PINCHY SPIDER warns victims of the planned data leak, usually via a blog post on their DLS containing sample data as proof (see below), before releasing the bulk of the data after a given amount of time. REvil will also provide a link to the blog post within the ransom note. The link displays the leak to the affected victim prior to being exposed to the public. Upon visiting the link, a countdown timer will begin, which will cause the leak to be published once the given amount of time has elapsed.

Dharma: Dharma ransomware attacks have been attributed to a financially motivated Iranian threat group. This RaaS has been available on the dark web since 2016 and is mainly associated with remote desktop protocol (RDP) attacks. Attackers usually demand 1-5 bitcoins from targets across a wide range of industries. Dharma is not centrally controlled, unlike REvil and other RaaS kits.

Dharma variants come from many sources, and most incidents in which CrowdStrike identified Dharma revealed nearly a 100% match between sample files. The only differences were the encryption keys, contact email, and a few other things that can be customized through a RaaS portal. Because Dharma attacks are nearly identical, threat hunters are not able to learn much about who is behind a Dharma attack and how they operate from a single incident.

LockBit: In development since at least September 2019, LockBit is available as a RaaS and is advertised to Russian-speaking users or English speakers with a Russian-speaking guarantor. In May 2020, an affiliate operating LockBit posted a threat to leak data on a popular Russian-language criminal forum.

Combating RaaS:

Addressing the issue of Ransomware as a Service (RaaS) requires a multi-faceted approach involving various stakeholders. Here are some key solutions that may help mitigate the impact of RaaS:

1. Enhanced Cybersecurity Measures: Organizations should implement robust cybersecurity measures to protect their networks, systems, and data. This includes using up-to-date security software, regularly patching vulnerabilities, enforcing strong access controls, and conducting regular security audits and risk assessments.
2. Employee Training and Awareness: Education and training programs are vital to raise awareness among employees about the risks of ransomware and how to recognize and respond to potential threats. This includes educating them on best practices for email and web browsing, avoiding suspicious links and attachments, and reporting any suspicious activity promptly.
3. Regular Data Backups: Maintaining regular backups of critical data is essential to minimize the impact of a ransomware attack. Organizations should follow the 3-2-1 backup rule, which involves keeping at least three copies of data, stored on two different media, with one copy stored off-site or offline.
4. Incident Response Planning: Developing a comprehensive incident response plan enables organizations to respond effectively in the event of a ransomware attack. The plan should include procedures for isolating affected systems, contacting law enforcement, engaging with cybersecurity experts, and restoring data from backups.
5. Collaboration and Information Sharing: Public-private partnerships between government agencies, law enforcement, cybersecurity firms, and industry associations can foster collaboration and information sharing to combat RaaS. Sharing threat intelligence, indicators of compromise (IOCs), and best practices helps organizations stay ahead of evolving ransomware threats.
6. International Cooperation:Ransomware attacks are often carried out across borders, making international cooperation crucial. Governments and law enforcement agencies should collaborate to extradite and prosecute cybercriminals involved in RaaS activities, dismantle criminal networks, and enforce stricter penalties for cybercrimes.
7. Public Awareness Campaigns: Raising public awareness about ransomware risks and prevention measures can help individuals and businesses protect themselves. Governments, industry associations, and cybersecurity organizations can launch public awareness campaigns to educate users about safe online practices and the consequences of engaging with RaaS.
8. Continuous Monitoring and Threat Hunting: Implementing robust security monitoring and threat hunting capabilities allows organizations to detect and respond to ransomware attacks promptly. This involves utilizing advanced threat detection technologies, behavioural analytics, and security information and event management (SIEM) solutions to identify and mitigate threats in real-time.

In coming future, Ransomware as a Service(RaaS) represents a significant threat to individuals, organizations, and society as a whole. Its accessibility and customizable nature have fuelled the growth of ransomware attacks, leading to devastating consequences. Combating RaaS requires a collective effort, with technology advancements, robust security measures, and collaboration between stakeholders. By staying vigilant, proactive, and informed, we can mitigate the risks posed by RaaS and safeguard the digital landscape against this evolving cyber extortion threat.