Ransomware as a service: The new face of industrialized cybercrime

The ransomware as a service model has facilitated a rapid refinement and industrialization of what less capable criminals can accomplish. In the past, these less sophisticated criminals may have used commodity malware they either built or purchased to perform attacks that are limited in scope, but now they can get everything they need—from access to networks to ransomware payloads—from their RaaS operators (for a price, of course). Many RaaS programs further incorporate a suite of extortion support offerings, including leak site hosting and integration into ransom notes, as well as decryption negotiation, payment pressure, and cryptocurrency transaction services.

This means that the impact of a successful ransomware and extortion attack remains the same regardless of the attacker’s skills.

One way RaaS operators provide value to their affiliates is by providing access to compromised networks. Access brokers scan the internet for vulnerable systems, which they can compromise and reserve for later profit.

In order to be successful, attackers need credentials. Compromised credentials are so important to these attacks that when cybercriminals sell network access, in many instances, the price includes a guaranteed administrator account.

What the criminals do with their access once it has been achieved can vary wildly depending on the groups and their workloads or motivations. The time between initial access to a hands-on keyboard deployment can therefore range from minutes to days or longer, but when the circumstances permit, damage can be inflicted at breakneck speed. In fact, the time from initial access to full ransom (including handoff from an access broker to an RaaS affiliate) has been observed to take less than an hour.

Once attackers gain access to a network, they are loathe to leave—even after collecting their ransom. In fact, paying the ransom may not reduce the risk to an affected network and potentially only serves to fund cybercriminals, who will continue trying to monetize attacks with different malware or ransomware payloads until they are evicted.

The handoff that transpires between different attackers as transitions in the cybercriminal economy occur means that multiple activity groups may persist in an environment using various methods disparate from the tools used in a ransomware attack. For example, initial access gained by a banking trojan leads to a Cobalt Strike deployment, but the RaaS affiliate that purchased the access may choose to use a remote access tool such as TeamViewer to operate its campaign.

Using legitimate tools and settings to persist versus malware implants such as Cobalt Strike is a popular technique among ransomware attackers to avoid detection and remain resident in a network for longer.

Another popular attacker technique is to create new backdoor user accounts, whether local or in Active Directory, that can then be added to remote access tools such as a virtual private network (VPN) or Remote Desktop. Ransomware attackers have also been observed editing the settings on systems to enable Remote Desktop, reduce the protocol’s security, and add new users to the Remote Desktop Users group.

One of the qualities of RaaS that makes the threat so concerning is how it relies on human attackers who can make informed and calculated decisions and vary attack patterns based on what they find in the networks where they land, ensuring they meet their goals.

Microsoft coined the term human-operated ransomware to define this category of attacks as a chain of activity that culminates in a ransomware payload, not as a set of malware payloads to be blocked.

While most initial access campaigns rely on automated reconnaissance, once the attack shifts to the hands-on-keyboard phase, attackers will use their knowledge and skill to try to defeat the security products in the environment.

Ransomware attackers are motivated by easy profits, so adding to their cost via security hardening is key in disrupting the cybercriminal economy. This human decision-making means that even if security products detect specific attack stages, the attackers themselves don’t get fully evicted; they attempt to continue if not blocked by a security control. In many instances, if a tool or payload is detected and blocked by an antivirus product, attackers simply grab a different tool or modify their payload.

Attackers are also aware of security operations center (SOC) response times and the capabilities and limitations of detection tools. By the time the attack reaches the stage of deleting backups or shadow copies, it’d be minutes away from ransomware deployment. The adversary would likely have already performed harmful actions like the exfiltration of data. This knowledge is key for SOCs responding to ransomware: investigating detections like Cobalt Strike before the ransomware deployment stage and performing swift remediation actions and incident response (IR) procedures are critical for containing a human adversary.