Ransomware as a Service (RaaS)

What is Ransomware as a Service (RaaS)?

Ransomware as a Service (RaaS) is a business model in which ransomware developers rent out ransomware variants, in the same way that legitimate software developers rent out SaaS (Software as a Service) products. With RaaS, all you need to do is subscribe to a service to launch ransomware attacks, even without advanced technical knowledge.

RaaS kits enable cybercriminals who lack the skills or time to develop their own ransomware variants to get up and running quickly, at an affordable cost. These kits are offered on the Dark Web with advertisements similar to those seen on the legitimate Web for conventional products.

A RaaS kit may include 24/7 support, bundled offers, user reviews, forums and other features identical to those offered by legitimate SaaS providers. The cost of a RaaS kit ranges from $40 per month to several thousand dollars, a pittance considering that the average ransomware demand in Q3 2020 was $234,000 (and rising). So a cybercriminal doesn’t need to win every time to get rich.

How the RaaS model works ?

The RaaS model is based on the SaaS (Software-as-a-Service) model, in which software is made available online on a subscription basis. However, the RaaS model also continues to evolve in its own way, and this fully functional and independent ecosystem thrives underground with its main players, namely operators who develop and sell ransomware. Operators are generally organized in groups and have designated roles such as leader, developers and infrastructure and system administrators.

All customers have to do is log on to the RaaS portal, create an account, pay in bitcoins, enter the characteristics of the type of malware they wish to create and click on the Submit button. Subscribers can access support, communities, documentation, feature updates and other benefits in the same way as subscribers to legitimate SaaS products. The most experienced RaaS operators provide portals for their subscribers to track infection status, total payments, total number of encrypted files and other information about their targets.

The RaaS market is very dynamic. In addition to their portals, RaaS operators launch marketing campaigns and have websites that look exactly like your own campaigns and websites. They record videos, write white papers and are active on Twitter. Ransomware as a service is a highly lucrative business: in 2020, total revenues from ransomware were close to $20 billion, compared with $11.5 billion the previous year.

Locky, Goliath, Shark, Stampado, Encryptor and Jokeroo are just a few examples of well-known RaaS kits, but there are many others. RaaS operators frequently disappear, only to reorganize and reappear with new, more powerful ransomware variants.

Thank you