Cybersecurity; Ransomware as a Service Provider

Cybersecurity threats are a constant presence, regardless of the business’s size—small companies can face as many potential threats as large corporations. Now, companies are facing a new, more organized threat in the form of ransomware as a service (Raas)

Yes, ransomware is now a service hackers can pay for. Since proactive ransomware remediation tactics are essential if an attack occurs, companies need to understand the potential threat a RaaS provider can pose to their business. So if you’re not sure what RaaS is or how it works, here’s what every business should know.

What is a RaaS Provider?

Are you familiar with software as a service (SaaS)/ Maybe your business is using subscription software provided by a third-party vendor? This is a common business practice for a host of reasons including its cost-effectiveness. You pay a monthly fee to use the software while the vendor takes care of all of the maintenance.

Ransomware as a Service (Raas) functions pretty much the same way. If you’re still having trouble wrapping your mind around hackers paying for subscription ransomware, you’re not alone.

While cyberthieves often still work alone, some are banding together to pool their talents and resources. This is when you get a type of company selling ransomware to their subscribers. Just think, you can pay a fee and send ransomware to just about any connected device.

Just to be clear; installing ransomware on any device not registered in your name is illegal and can have serious repercussions. In other words, don’t sign up for the service. With that being said, here’s a quick look at how the service works.

How a RaaS Works

So, developers partner with affiliates: developers are responsible for writing the ransomware code and affiliates are the service’s paying subscribers. The affiliates purchase the code, prices often range from around $100 up to $1,000 and occasionally more.

After purchasing the ransomware, affiliates install the malware on a company’s network. Operations at the affected business are shut down until the ransom is paid, usually with hard-to-track cryptocurrency. Since cryptocurrency is the preferred payment method, it’s tough for industry regulators to track the ransomware’s origins.

Finally, the ransom is divided between the developers and affiliates, making it a lucrative business for everyone except the affected company. Since both developers and affiliates are getting paid, it’s easy to see why RaaS is becoming a big business and a growing threat.

Basic Raas Revenue Models

RaaS providers are following SaaS (software as a service) business models almost to the letter. Once again, if you’re familiar with SaaS you already have a good idea of a RaaS payment model

Most ransomware providers follow one of the four revenue models. Neither is extremely complex and the one a provider uses typically depends on the number of code developers and affiliates. So, what are the basic RaaS revenue models?

• We briefly touched on monthly subscriptions. This model is popular with smaller service providers. Affiliates pay a monthly fee and receive a small percentage of the paid ransom. The majority of the ransom goes to the developers.
• If the service is using affiliate programs, they’re aiming to reach two goals. The service wants to increase profits and boost efficiency. In this model, the affiliates responsible for distributing the ransomware earn a higher percentage than the service’s operators. The hope is with larger affiliate incentives, they can infect a larger number of networks and devices.
• One-time-only licensing fee allows users unlimited access to ransomware. However, there isn’t any profit sharing. The affiliate keeps all of the profit. To ensure developers are paid, the one-time licensing fee tends to be expensive.

The final commonly used revenue model is pure profit sharing. Both affiliates and operators receive a percentage of the ransom. The amount each receives is determined when the user purchases the license. In a sense, this revenue model is a combination of the above three.

As you can see, ransomware as a service is becoming a well-organized business and this significantly increases the threat to your business.

Where RaaS Is Heading

RaaS attacks are increasing in frequency and starting to surpass single-oriented cyber-attacks. Instead of one individual writing malicious code and trying to poke around in your network, it’s become a team effort backed by a service provider.

Unfortunately, it’s not only businesses facing this emerging threat. RaaS providers are also targeting infrastructure like transportation, healthcare, and energy. By increasing your cybersecurity protocols to meet the changing threats, you can stay a step ahead of ransomware attacks.