Off-the-Shelf Havoc: Ransomware as a Service

In selling access to ready-made cyber attack kits, RaaS provides the same ease of use as the software as a service (SaaS) model that inspired it. With SaaS, “I can basically pay someone to do most of the work on my behalf. I don't have to worry about installing the software, maintaining the software, updating the software,” Jason Kichen, chief information security officer at the software testing and quality engineering firm Tricentis, explains. 

And RaaS is no different, except that the software is code that enables non-experts to gain control of the targeted organization’s data, hold it hostage and extract ransom, typically in the form of cryptocurrency. The cybersecurity world has taken notice, because ransomware as a general threat was already keeping them up at night. 

“I think for most chief information security officers, [ransomware] is the closest thing you get to what we would consider an existential threat,” Kichen says. “This is the type of thing that when it goes bad, if it goes wrong, can literally be the difference between your company surviving and not surviving.” 

And now, RaaS has brought in a whole new group of potential attackers. “I believe moving forward, we will see an expanded number of attacks, and they will be more damaging," says Jessica Doherty, a senior manager and strategist at Broadcom Mainframe Software.

The victims may take no comfort in the notion that it’s just business, but that’s what it is. “Anytime you see money in a business, you want to make it a true business. And these are really true businesses. They actually have set up call centers and so forth,” Desai says. 

This collaboration happens more or less out in the open, Kichen says. When people think about RaaS, “they imagine criminals in a dark alley meeting under the cover of night, exchanging cash in a suitcase, like a very cloak-and-dagger type of deal,” he says. “The reality of it is, it's not quite completely out in the open, but it's pretty much out in the open.” While the RaaS providers are generally found on the dark web, that’s not exactly hidden away, since anyone can access it with a Tor browser, Kichen notes. 

“It's really become a subscription-based business where anyone can launch an attack,” Desai observes. “I have a 14-year-old son who could probably go use, probably spend $20 on the dark web and buy a prebuilt ransomware kit and find instructions on how to actually launch it, and then can have a third party actually do the negotiation.”

While RaaS is a relatively new feature on the threat landscape, the way to defend against it doesn’t differ from regular ransomware precautions. In guarding against RaaS, “we do the same things that we've always been doing against digital threats that we've been doing for 10, 20 years or longer,” Kichen says. However, given the presumed increase of threats brought by RaaS, cybersecurity professionals might feel more urgency to shore up weak points. 

That includes enforcing multi-factor authentication (MFA) across all access points, layered security, diligent software updating and vulnerability patching and continuous monitoring, Desai advises. Doherty adds, “Cybercriminals seek the easiest entry points, so the best defense is to close off the most common vulnerabilities.”

Keeping secure, offline backups is another precaution, “because now what our attackers are really doing is they're targeting cloud backups too,” Desai says. And remember that your employees are human. “Your employees are really the weakest links, because if your employees don't know what to look for, they're going to get exploited,” Desai says. “So employee training that's done more than once a year, that's more than just a checkbox, I think is really important.” 

Despite all those precautions, it’s also important to have a plan for responding to a successful attack, she adds. That includes being ready to pay up, if necessary. “Should you buy Bitcoin? Yeah, probably,” Desai says.