Ransomware-as-a-Service (RaaS) isn’t new and is evolving daily, making it even easier for criminals without technical know-how to stage an attack. The RaaS model broadens the entry threshold for this cybercrime business. Ransomware developers can lease out their ready-made malware as well as infrastructure. As such, there is an increasing number of ransomware attacks while the fight against ransomware is being hindered. Even if the malware developers are caught, their customers can still stage criminal activities.
Common ransomware gangs that are threatening organizations or even government departments are Darkside, Conti, Revil, Ragnorak, DEV-0193 cluster (Trickbot LLC), and others. These groups have been responsible for numerous attacks in recent times.
DarkSide: This ransomware gang is thought to have been behind the attack on the Colonial Pipeline that forced the company to shut down approximately 5,550 miles of pipeline, causing countless barrels of diesel, gasoline, and jet fuel to remain stranded on the Gulf Coast.
Ragnorak: This ransomware gang, which is believed to have dispersed or ended its operations in August 2021, was responsible for many attacks worldwide. One of the group’s major successful attacks was the April attack on Boggi Milano, an Italian fashion line, whereby 40 GBs of internal data was stolen. including payroll files. These ransomware gangs may close their businesses for a while, only to regroup later and begin their mission again.
Conti and Lapsus$: This ransomware gang held the Costa Rican government to ransom, while the Lapsus$ ransomware group targeted both Microsoft and Okta.
Ransomware gangs are similar to organized crime families. They are well coordinated, highly organized, and have leaders and other team members. Organized crime families are organized into territories and respect each other’s territorial operations. They commit various money crimes, including loan sharking and protection rackets. Once they extort their victims, they funnel the take-up, each taking their share as agreed upon.
On the other hand, ransomware gangs operate more autonomously. They have less control over territories or targets and usually take a small cut. However, they tend to have a much grander scale. Ransomware gangs can operate from countries like China, Russia, and North Korea without repercussions. Since the ransomware owners work closely with affiliates, the affiliates take more of the risk depending on the locations they operate from. Different countries have different jurisdictions regarding cybercrime and ransomware gang operations. As such, countries that are aggressive in preventing cybercrime might not be hot spots for the affiliates or even the leaders of the gangs.
RaaS highlights the way cybercrime has become a fully-fledged economy. The RaaS gig economy is also referred to as human-operated ransomware. This is a term that was coined by Microsoft. The gig economy consists of the ransomware owners, who are the developers of the malware used to conduct criminal activities. Ransomware operators also provide a support system for the affiliates. Affiliates rent the software and execute the attacks. Access brokers are involved in securing the entry point to a network in which RaaS is deployed. In other words, access brokers sell compromised access.
The profits that are earned from an attack are usually split between the software developers and the attackers. The attacks tend to evolve their patterns based on the kind of weakness they find within the target security systems.
The RaaS model begins with expertly coded ransomware, a product of skillful ransomware owners. These developers allow affiliates to sign up to distribute malware. The developers provide the support needed to allow the affiliates to get as many customers as possible.
Usually, when the ransomware has been developed, the developers modify it to accommodate multi-end user infrastructure. It is ready to be used by multiple affiliates who are licensed to use the product. The RaaS revenue model works so that the affiliates sign up for the malware with a monthly subscription or a one-time fee. Some RaaS solutions use commissions as a way of affiliate sign-up.
Ransomware affiliates are provided with step-by-step guides on launching ransomware attacks using the malware. Again, some RaaS distributors offer a dashboard solution that allows the affiliates to monitor the progress of each ransomware attack attempt.
The ransomware gang handles the payments, provides the decryption keys, and then gets their cut.
The attacks can lead to downtimes for your business, the closure of operations, and result in costly ransoms. Therefore, the best approach is to prevent attacks before they happen.
Use Deep MFA – The goal of deploying multi-factor authentication is to create a multi-layered defense system for your network or device access. This ensures that the users accessing the system are who they claim to be. If one factor gets compromised, there are more barriers for an attacker to breach. So, don’t let attackers gain entry to your backup software. Using the MFA authentication method allows the users to verify their identity via multiple independent methods.
Use Advanced Bidirectional Malware Scanning – Get all backup files scanned in real-time to help isolate malware or malicious codes and alert your team of an infection. When restoring the backup, get the recovery files scanned to put off the attack loop. Often, an attack loop is triggered when you try to restore a backup that is infected with ransomware. The restoration activates the ransomware. Don’t let attackers slip ransomware/malware into your backups.
Don’t be a path of least resistance – Since attackers will attempt to attack weaker targets, you should ensure that you create a robust defense system for your networks. Implement reliable, state-of-the-art endpoint protection that works on advanced algorithms and functions automatically in the background 24/7.
At Asigra, we are committed to protecting you from ransomware attacks. We employ various techniques and malware protection tools and techniques to help you keep the attackers away.