02-28-17 | Blog Post
Ransomware
has made headlines time and again for its devastating effectiveness on governments and organizations, but researchers are starting to pay attention to a developing trend within ransomware: Ransomware as a Service (RaaS). Ransomware as a Service allows anyone, regardless of programming background or coding skills, to infect computers and extract money from victims.
Why are researchers paying attention to RaaS? It represents a new form of malware distribution, where people who have zero coding or programming skills can send out malicious software, same as experts can. A wider distribution net means criminals can make more money off victims—there’s more of them to go around—and can be blamed for ransomware’s popularity. As ransomware continues to be a popular method of moneymaking for criminals (they made off with about $1 billion in 2016) the price to supply it is low (ranging anywhere from $10-$100), making it easy for anyone to purchase and use.
How does RaaS work? Essentially, someone interested in spreading ransomware to a person or company buys an exploit from a vendor kit that contains everything they need for their attack. In exchange for the code, the buyer pays a fee and usually must give the seller a percentage of the ransoms they get—sometimes up to 40 percent. This is a win-win for criminals: Not only can they make money from their own victims, but also the victims from anyone they sell their malware to.
Once the buyer has completed the transaction and is ready to infect a device, they distribute it through their own means. Phishing attacks are still the most popular method–RaaS is no different. Criminals have found it easier to exploit human error than cybersecurity software, and take advantage accordingly. Research has found companies are woefully unprepared for these types of attacks despite their popularity, and cybersecurity experts encourage businesses to train employees to recognize signs of a phishing attempt, along with practicing other safe cyber habits.
As long as ransomware continues to grow in size and scope, RaaS isn’t going anywhere. It offers more opportunities for criminals to infect victims and extort money from them. Organizations must maintain vigilance and increase security training for their employees to lower the risk of falling for a phishing attack. Increasing employee awareness, along with other cybersecurity strategies such as disaster recovery, two-factor authentication and strong firewalls can help mitigate the threat ransomware poses.
If you’re curious about ransomware, learn more from these blog posts:
What is ransomware and how do you protect against it? Ransomware has been rising at an “alarming rate,” according to security researchers, with a 3,500 percent increase in criminal use of net infrastructure that helps run ransomware campaigns. It can affect anyone with a computer or mobile device, and there are already plenty of examples… (read more)
Ransomware and healthcare: What you need to know: Ransomware was officially a billion dollar crime in 2016, with more than 4,000 attacks since Jan. 1 and at least 25 variants of ransomware discovered. Researchers have predicted they would discover more than 100 variants before year’s end… (read more)
Seven best practices for securing yourself against ransomware in 2017: Ransomware may have possibly taken the crown as THE crime to beat in 2016, with record growth and profits for criminals. While payments used to start around $50, the average payout is now $679, with $209 million paid out in Q1 of 2016 alone… (read more)
