Many types of threats have become available as a service, which makes it possible even for those without sufficient technical knowledge to cause cyberattacks. Here is everything you need to know to stay safe from Ransomware-as-a-Service (RaaS) and Phishing-as-a-Service (PhaaS).
Threats monetised
In the past, executing a sophisticated cyberattack took much work. A potential attacker needed to know how to code, develop functional, sophisticated software, remain anonymous to the victims… Nowadays, the situation has changed, and platforms offer ransomware or phishing-as-a-service to anyone interested in using these threats against someone or earning money through criminal means.
RaaS and PhaaS models are pretty similar to the software-as-a-service (SaaS) business model: an operator develops software and sells it to an affiliate who can have little to no knowledge of coding and development – only in this case, the software is malicious.
Apart from creating the malware, the operators may also offer technical support to the affiliate and a step-by-step guide for launching the attack. They often present their product online, look for affiliates on dark web forums, and promote their product with elaborate reviews.
While some operators only recruit affiliates with advanced technical skills to make their chances of profit higher (such as the Circus Spider cybercrime group), other RaaS and PhaaS owners look for anyone willing to use their product and pay enough money.
Ransomware or phishing-as-a-service can be bought based on different revenue models. The affiliate may pay a one-time price for the service or pay a monthly fee to keep using the malware. In the case of RaaS, some operators may also demand a percentage of the paid ransom. Given that the average ransom payment was around $228,125 in 2022, it only takes a few successful attacks to make the service profitable for both the operator and the affiliate.
Cybercriminals have also realised they can make more money by executing human-operated attacks and targeting businesses directly. By aiming their attacks at specific companies, they can get to know their targets better and launch the attacks when they are most vulnerable, for instance, on holidays or weekends.
As a result, ransomware attacks are not only accessible to nearly anybody – they are also increasingly more successful.
Digital crime as a business model
There are many different operators offering their malware online, and each year, more are launching their businesses. Most of them are far from cybercriminal amateurs. Highly developed cybercriminal groups often offer RaaS and PhaaS with a network of employees that take care not only of the coding and development but also customer service, negotiations, and more.
Among some well-known gangs is the CARBON SPIDER group, associated with the DarkSide RaaS operation, or the PINCHY SPIDER group, which sells the common REvil (or Sodinokibi) ransomware, known for the highest demanded ransom of $70 million. Some famous ransomware comes from unknown sources – for instance, the Dharma attacks, which have been associated with an unknown Iranian criminal group, or the Ryuk ransomware, which mainly targets public entities, such as US schools.
Percentage of the top 10 types of reported ransomware
1. REvil / Sodinokibi – 14.2%
2. Conti V2 – 10.2%
3. Lockbit – 7.5%
4. Clop – 7.1%
5. Egregor – 5.3%
6. Avaddon – 4.4%
7. Ryuk – 4%
8. DarkSide – 3.5%
9. Suncrypt – 3.1%
10. Netwalker – 3.1%
Source: Cloudwards, 2021
As for the PhaaS attacks, most of them focus on Western services, but there is also the Caffeine platform that targets Russian and Chinese markets and collects login credentials from the victims by faking a Microsoft login page. Caffeine exemplifies the latest accessibility of threats, as the platform’s services are available to just about anyone with an email address.
How to stay secure
How to protect yourself and your employer from phishing and ransomware? Here are some basic rules every employee should follow:
1. Stay alert when reading emails. Learn to recognise phishing and react cautiously whenever you receive a message from someone you don’t know or an email that seems suspicious. If you are unsure about the authenticity of an email, don’t click on any links or open any attachments, and consult the situation with your IT team.
2. Know – and follow – the basics of password hygiene. Use a different password for each of your accounts, and always try to create a complex password that is difficult to guess but easy to remember, or even better, use a passphrase. Use a reliable password manager recommended by your IT specialists to help you remember all your credentials.
3. Always back up data. Employees should know how to back up their documents and which online and offline storage can use to keep their files safely.
4.Stay informed. Get to know some common threats you may encounter and learn how to react to them. Likewise, get to know your company’s policy and crisis plan to prepare you to act if you fall victim to phishing or ransomware. Try to keep your knowledge up-to-date with the rapid development of technology, as there are constant changes in the potential threats and how to protect yourself from them.
5. Opt for a reliable solution. To stay protected from RaaS and PhaaS, use a solution that shields your devices from ransomware and phishing. With proper education, beneficial security habits, and software protection, it will be difficult for cyber-attackers to turn you or your company into their victim.
