Ransomware as a Service (RaaS) – The Business of Ransomware

guest · Aug 12, 2020

RaaS: Ransomware as a Service
April 21, 2020
https://zvelo.com/raas-ransomware-as-a-service/

Overview
RaaS-type businesses sell or rent out compact, easy-to-deploy, and scalable malware kits to individuals or groups who want to stage cyber attacks. These RaaS kits are typically promoted and sold on the dark web using the same marketing and sales tactics that legitimate businesses use. Those who access the dark web will find a plethora of ads displayed in underground forums promoting different RaaS at different price points with varying degrees of service.

The cost for a RaaS kit can range anywhere from around $40 up and scale upwards into the thousands. Even at a cost of thousands, the cost of the RaaS kit is nominal when attackers see the potential to claim a high dollar ransom from a BGH target.
Click to expand...

Revenue Models
RaaS operators use the same types of revenue models as legitimate businesses. Some operators will sell their services for a flat fee, or monthly subscriptions. Others choose to use the profit sharing model.
Affiliate programs are another channel for RaaS operators to generate revenue.
Ease of Use
You select a package based on price and services included, create an account login, add some criteria to the type of malware you wish to create, and then you’re set.
Click to expand...

guest · Aug 12, 2020

Anomali Threat Research Releases First Public Analysis of Smaug Ransomware as a Service
August 10, 2020
https://www.anomali.com/blog/anomal...lic-analysis-of-smaug-ransomware-as-a-service

Threat actors and cybercriminals that don’t have the ability to develop their own ransomware for malicious campaigns can turn to the Smaug Ransomware as a Service (RaaS) offering, which is available via a Dark Web Onion site. At least two threat actors are operating the site, providing ransomware that can be used to target Windows, macOS, and Linux machines
Threat Actor
The Smaug RaaS appears to be operated by one to two threat actors that are both active on the criminal underground. One of the threat actor’s online handles on the forums has been identified. The second operator still is unknown. [...]
Click to expand...

Manage Campaign
With a campaign created, a user can download the relevant payload for the system(s) they are attempting to infect; Mac, Linux and Windows are all available. The dashboard also will keep track of how many systems have been infected, this is done through allowing a victim one free decryption of a single file, this is then recorded and updates the dashboard.
Support
The Smaug developers claim to run a support service to assist with bugs and other issues. They also claim to take feature requests, they will create them for a fee or incorporate them for free if enough users request it.
Click to expand...

Conclusion
Smaug is a RaaS that makes it easy for threat actors to use ransomware to achieve objectives. The ransomware can run on all the three major operating systems that opens up the potential for broader targeting. The actual ransomware is relatively simple compared to common ransomware currently being used by other threat actors. The malware’s only functionality is the encryption of files.
Click to expand...

guest · Aug 12, 2020

Dharma ransomware created a hacking toolkit to make cybercrime easy
August 12, 2020
https://www.bleepingcomputer.com/ne...ed-a-hacking-toolkit-to-make-cybercrime-easy/

The Darhma Ransomware-as-a-Service (RaaS) operation makes it easy for a wannabe cyber-criminal to get into the ransomware business by offering a toolkit that does almost everything for them.

A RaaS operation is a cybercrime model where the developers are in charge of managing the ransomware development and ransom payment system. At the same time, affiliates are responsible for compromising victims and deploying the ransomware
As part of this model, the developers earn between 30-40% of any ransom payments, and the affiliates make the rest.

One of the oldest ransomware families operating today is the Darhma ransomware.
Click to expand...

Dharma RaaS offers a ready-made toolkit for wannabe hackers
New research from Sophos may explain why the ransom demands are so much lower for Dharma ransomware attacks than other operations; it caters to a less experienced affiliate.
Unlike many private RaaS operations that only work with experienced hackers, it has been discovered that the Dharma operators offer a ready-made toolkit that allows anyone wannabe hackers to compromise a network.

Known as 'Toolbelt', this toolkit is a PowerShell script that, when run, allows the attacker to download and execute a variety of tools from a mapped Remote Desktop shared '\\tsclient\e' folder.

"We don’t know if all of them use the same toolset, but we’ve seen the same pattern of attack across many, many Dharma attacks, so we believe they may all at least come from a single original source and are used widely," Sophos researcher Sean Gallagher told BleepingComputer.
Click to expand...

Sophos: Color by numbers: inside a Dharma ransomware-as-a-service attack

Dharma, a family of ransomware first spotted in 2016, continues to be a threat to many organizations—especially small and medium-sized businesses. Part of the reason for its longevity is that its variants have become the basis for ransomware-as-a-service (RaaS) operations—the fast-food franchise of cybercrime.

Three recent attacks documented by SophosLabs and Sophos MTR have revealed a toolset used by Dharma “affliliates” that explains why attacks from so many different Dharma actors seem so identical, down to the tools and commands they use.
The Dharma playbook
Most Dharma operators don’t make significant changes to the source. But Dharma RaaS operators appear to package together a number of tools and best practices for their “affiliates” to use once they’ve gotten onto a victim’s network.
Click to expand...

guest · Sep 5, 2020

New RaaS “SMAUG” Wants to Take All the Ransomware Treasure
September 4, 2020
https://www.technadu.com/new-raas-smaug-wants-take-all-ransomware-treasure/193891/

A new ransomware as a service (RaaS) platform named “SMAUG,” which first appeared in April 2020, wants to dominate the field and render every other offering obsolete. Similarly to how Tolkien’s fictional dragon character “Smaug” was the greatest of his kind and sincerely interested in Erebor’s vast treasures.
So, if that is the goal, would the firepower of “SMAUG” be enough to justify these aspirations? A Sentinel Labs report is helping us answer that question.

First of all, SMAUG is open to everyone willing to join the platform, so it doesn’t operate in a confined context like other RaaS. Secondly, it’s a complete and robust service that doesn’t have downtimes or inconsistencies. Thirdly, the fee charged by the operators of the service is set to 20%, which is relatively low. There is a 0.2 BTC registration fee to enter the dragon’s realm, though, but this assures that only serious crooks will join.
Click to expand...

In regards to AV detection evasion, SMAUG relies on obfuscation and crypting, while its payloads were developed with footprint minimization in mind.

As for the payment process, there’s a fully automated system that can be customized by the user, so there are no fixed ransom amounts, standard messages, etc. This is another example that underlines the open nature of SMAUG.
Click to expand...

SentinelLabs: Multi-Platform SMAUG RaaS Aims To See Off Competitors

Still, every now and then we stumble across a fully public service. It gets even more interesting when that service offers a “seamless” experience across OS platforms. Ransomware families with full feature parity across Windows, Linux and macOS do not pop up all that often, which brings us to today’s topic: the SMAUG RaaS (Ransomware as a Service) offering.
Click to expand...

guest · Sep 10, 2020

The Role of Initial Access Brokers in the Ransomware Scene
Hackers who compromise firms sell their services to RaaS groups, as the demand is rising
September 9, 2020
https://www.technadu.com/role-initial-access-brokers-ransomware-scene/198630/

Ransomware groups are working like fine-tuned machines, assigning distinctive roles to specific teams and raising their money-making effectiveness to the maximum level. But for anything “nasty” to happen, one needs to establish initial access to the target’s systems, and this is maybe the most time-consuming and complicated process.

One has to scan the target for vulnerabilities, identify potential opportunities, and then break in without getting detected. A report from Digital Shadows touches this subject, focusing on the “initial access” actors and their role in the rise of the RaaS problem.
Click to expand...

Hackers who are able to access company systems remotely are promoting their services to ransomware groups on dark web forums, and these listings have risen to unprecedented levels this year. From network access to full RDP domain admin access, the listings come with price tags between $500 and $10,000.
The hackers don’t care about who’s buying their services and what they’re planning to do with the access, they just want to make money – and they are.

The greater the risk, the larger the cheese, but generally, those who have managed to break in a large organization’s systems are starting from a good point.
Click to expand...

The re-ignition of RaaS (ransomware as a service) groups and the addition of file-stealing extortion platforms have sucked more crooks in the particular field, and there’s an entire money-making industry of inter-supporting groups of actors at the moment.
Click to expand...

Digital Shadows: Not Another Ransomware Blog: Initial Access Brokers And Their Role

Listings are customer agnostic; the goal is to make money, so whoever wants to buy their access (e.g. nation-state APT, financially motivated groups, data brokers) can have it.

Organizations with higher revenue and higher employee size would obviously garner more attention; a successful ransomware infection of an organization with a considerable revenue will prove more lucrative.
Click to expand...

guest · Sep 28, 2020

“REvil” Displays Power and Size With $1 Million Deposit on Forum
One million USD is nothing for REvil, as they clearly show they aren’t stressed over losing the amount
September 28, 2020
https://www.technadu.com/revil-displays-power-size-1-million-deposit-forum/212122/

If there’s one sure way to convince potential affiliates that you mean serious business, that would be by “showing them the money.” REvil/Sodinokibi has just done that by depositing $1 million in Bitcoin on a Russian-speaking hacker forum, making their case-crystal clear. They are there to recruit capable hackers, and they have the financial resources to recompense the best of the best.

The message posted by the REvil group on the forum states a case of operational expansion for which they need talented advertisers and testers.
The purpose of the deposit on this forum is to buy services or data dumps offered for sale there, so the platform is offering this system as a type of security escrow.
Click to expand...

REvil is a “Ransomware as a Service” (RaaS) that has had around 150,000 unique infections between Q3 and Q4 2019, using at least 148 distinct payloads and demanding ransoms of an average of $260,000.
This size of operations is making REvil millions per week, and the group is following an upwards trend. As we can deduce from the present forum post, REvil is not going for more targeted operations yet, as they are still looking to extend their network and magnify their earnings.
Click to expand...

guest · Oct 12, 2020

Underestimating the FONIX – Ransomware as a Service could be an error
October 11, 2020
https://securityaffairs.co/wordpress/109369/cyber-crime/fonix-raas.html

FONIX is a relatively new Ransomware as a Service (RaaS) analyzed by researchers from Sentinel Labs, its operators were previously specialized in the developers of binary crypters/packers.
The actors behind FONIX RaaS advertised several products on various cybercrime forums.

Experts pointed out that the ransomware authors don’t require the payment of a fee to become an affiliate of the service, the operators only keep a percentage of any ransoms from their affiliate network.

“Notably, FONIX varies somewhat from many other current RaaS offerings in that it employs four methods of encryption for each file and has an overly-complex post-infection engagement cycle.” reads the analysis published by Sentinel Labs.
The communications with the RaaS operators are carried out via email. Any affiliate has to provide the operators files from a victim system to obtain the decryptor and key for the victim, in turn the operators keep for them 25% of the ransom.
Click to expand...

SentinelLabs: The FONIX RaaS | New Low-Key Threat with Unnecessary Complexities

FONIX Raas (Ransomware as a Service) is an offering that first came to attention in July of this year. It did not make much of a splash at the time, and even currently, we are only seeing small numbers of infections due to this ransomware family. However, RaaS that at first fly under the radar can quickly become rampant if defenders and security solutions remain unaware of them.
Conclusion
FONIX is not at present a widespread threat; whether that is due to the complexity of its engagement model or other factors is difficult to say at this time. However, a FONIX infection is notably aggressive – encrypting everything other than system files – and can be difficult to recover from once a device has been fully encrypted.

Currently, FONIX does not appear to be threatening victims with additional consequences (such as public data exposure or DDoS attacks) for non-compliance.
Click to expand...

guest · Oct 29, 2020

REvil ransomware gang claims over $100 million profit in a year
October 29, 2020
https://www.bleepingcomputer.com/ne...ang-claims-over-100-million-profit-in-a-year/

REvil ransomware developers say that they made more than $100 million in one year by extorting large businesses across the world from various sectors.

They are driven by profit and want to make $2 billion from their ransomware service, adopting the most lucrative trends in their pursuit of wealth.
Affiliates do the heavy lifting
A REvil representative that uses the aliases “UNKN” and “Unknown” on cybercriminal forums talked to tech blog Russian OSINT offering some details about the group’s activity and hints of what they have in store for the future.
Like almost all ransomware gangs today, REvil runs a ransomware-as-a-service (RaaS) operation. Per this model, developers supply file-encrypting malware to affiliates, who earn the lion’s share from the money extorted from victims.

“Most work is done by distributors and ransomware is just a tool, so they think that’s a fair split,” REvil representative, Unknown, told Russian OSINT.
Click to expand...

REvil’s model for making money is working and the gang already has plenty in their coffers. In their search for new affiliates, they deposited $1 million in bitcoins on a Russian-speaking forum.
The move was designed to show that their operation generates plenty of profit. According to Unknown, this step is to recruit new blood to distribute the malware, as the ransomware scene is full to the brim with professional cybercriminals.

BleepingComputer was told that Unknown confirmed that the interview (in Russian) was real.
Click to expand...

An Interview with "UNKN" Sheds Light on REvil's Operations & Future Victims

Conclusion:
As AdvIntel predicted in July 2020, REvil did significantly increase its public presence and became very communicative with the non-underground and underground communities alike. This trend will likely continue as it concords with the group’s psychological and criminal identity profiles. We may expect more information being shared by UNKN in the future, enabling us to better understand this syndicate and its future attacks.
Click to expand...

Flashpoint: Moving To “Ransomware-as-a-Service”: Operator “REvil” Dishes in Periodical-Style Q&A

Cybercrime is a lucrative business these days. And those that do it well, increasingly organize and operate as legitimate businesses do. Cybercriminal groups develop sophisticated business models with organizational structures that mirror even complex enterprise corporations.

The growth and evolution of ransomware attacks highlight this type of criminal corporatization–as well as the business strategy spurring its growth.
Click to expand...

guest · Nov 4, 2020

Ransomware-as-a-Service Becomes Increasingly Accessible via Social Media and Open Sources
November 4, 2020
https://www.recordedfuture.com/ransomware-as-a-service/

Hackers need not search the dark web for access to their very own ransomware platforms these days.

Cybercriminals are continually finding new ways to promote their underground businesses and gain the attention of new customers and novice hackers. Several threat actors have recently taken to popular social media and open sources like YouTube, Vimeo, and Sellix to advertise and demonstrate their discount-priced $40 ransomware-as-a-service (RaaS) builder called ZagreuS.

The ZagreuS ransomware offers several attractive and easy-to-use features that make it accessible and manageable for low-level beginner hackers.
Click to expand...

According to the original seller, ZagreuS is designed for attacking larger networks of companies, enterprises, and hospitals. The 11-minute demo video posted on YouTube describes that the seller will receive a 30 percent commission for each ransom collected, while the remaining 70 percent is kept by the operator/buyer. The ransomware builder is currently trending at a low price of $40 USD, paid in cryptocurrency to the sellers wallet.

Many online platforms and social media applications are aware of these advertisements and work to have them removed.
When this particular demo video was removed from the original YouTube channel, the threat actor quickly uploaded it again under a different link and pivoted to other platforms for clear web and deep web marketing, including sellix.io, RAID forums, hackforums, and Github.
Click to expand...

Although the barrier of entry for threat actors to get into ransomware has been lower than ever, very few criminals make a profit off of these low-cost, simple RaaS tools. However, those that are successful have taken advantage of the situation and have increased ransom demands. Some are even practicing double exploitation of their victims — demanding a ransom, and still releasing the victims’ personal data for sale on underground forums after they have paid.
Click to expand...

guest · Nov 12, 2020

Darkside Ransomware Gang Launches Affiliate Program
Using Affiliates Enables Crowdsourced Profits, But Leaves Operators More Exposed
November 12, 2020
https://www.bankinfosecurity.com/blogs/darkside-ransomware-gang-launches-affiliate-program-p-2968

Darkside is the latest ransomware gang to announce that it's launched an affiliate program, as part of its bid to maximize revenue.

In recent days, the operators behind Darkside have taken to XSS and Exploit - two major, Russian-language cybercrime forums - to announce the details of its new affiliate program, reports, Israeli cyberthreat intelligence monitoring firm Kela reports.

"The share paid to affiliates is 10% to 25%, depending on the size of the ransom."
Here's how such affiliate programs work: Ransomware operators provide crypto-locking malware code to third parties. Each affiliate receives a version of code with their unique ID embedded. For every victim that pays a ransom, the affiliate shares the take with the ransomware operator.
Click to expand...

Affiliate Program Upsides
Running an affiliate program offers numerous upsides. For starters, the ransomware operator handles the technical side, including "product updates." Once the operator has built all required infrastructure - typically including a self-service portal for victims to pay - they can in theory scale to handle as many affiliates as they want.
Two Main Downsides
So, what are the downsides to running an affiliate program? Kivilevich highlights two main problems: reputation and infiltration.
Reputationally, if an affiliate does something bad, that reflects on the operator, as Darkside has noted in one of its posts.

Relying on affiliates also means that the ransomware operation may be inadvertently recruiting undercover security researchers or law enforcement agents, who might potentially "gather more intelligence about their activities," Kivilevich says.
Click to expand...

guest · Nov 13, 2020

mood said: ↑

Darkside Ransomware Gang Launches Affiliate Program November 12, 2020
Click to expand...

DarkSide ransomware is creating a secure data leak service in Iran
November 13, 2020
https://www.bleepingcomputer.com/ne...-creating-a-secure-data-leak-service-in-iran/

The DarkSide Ransomware operation claims they are creating a distributed storage system in Iran to store and leak data stolen from victims. To show they mean business, the ransomware gang has deposited $320 thousand on a hacker forum.

DarkSide is run as a Ransomware-as-a-Service (RaaS) where developers are in charge of programming the ransomware software and payment site, and affiliates are recruited to hack businesses and encrypt their devices.
DarkSide deposits $320 thousand on a hacker forum
As part of this same forum topic, the DarkSide operation announced that they were looking for new Russian affiliates to join their program, who they claim to earn an average of $400k per victim.
As part of this recruitment drive, affiliates must pass an interview and answer any questions the developers have about their level of experience.

"Pass an interview, show your work and payments, answer the necessary questions." - DarkSide developers.
Click to expand...

These deposited bitcoins can then be transferred to other members to purchase software, services, or information.
This show of wealth is similar to REvil's recruitment drive in September when they deposited $1 million in bitcoins to the same forum.
Click to expand...

guest · Nov 15, 2020

mood said: ↑

DarkSide ransomware is creating a secure data leak service in Iran November 13, 2020
Click to expand...

DarkSide ransomware's Iranian hosting raises U.S. sanction concerns
November 15, 2020
https://www.bleepingcomputer.com/ne...-iranian-hosting-raises-us-sanction-concerns/

Ransomware negotiation firm Coveware has placed the DarkSide operation on an internal restricted list after the threat actors announced plans to host infrastructure in Iran.
DarkSide plans to host infrastructure in Iran
To prevent their data leak service from being taken down, the DarkSide gang announced this week that they are building a distributed and sustainable storage system in Iran and other "unrecognized republics." With this system, if one server is taken down, the data will still remain and be available on the other servers.
Click to expand...

"DarkSide's own TOR site announces the intent to use infrastructure hosted within Iran, a sanctioned nexus. The purpose of this infrastructure is to store data stolen from victims of ransom attacks. It is probable that a portion of the proceeds from any prospective ransom payment to DarkSide would be used to pay services providers within Iran. Accordingly, we have placed DarkSide on our restricted list," Coveware CEO Bill Siegel told BleepingComputer.

BleepingComputer has learned that an email sent to partners explains that this is Coveware's decision and not part of any U.S. policy.
Click to expand...

guest · Nov 16, 2020

The ransomware landscape is more crowded than you think
More than 25 Ransomware-as-a-Service (RaaS) portals are currently renting ransomware to other criminal groups
November 16, 2020
https://www.zdnet.com/article/the-ransomware-landscape-is-more-crowded-than-you-think/

Ransomware-as-a-Service is a cyber-security term referring to criminal gangs that rent ransomware to other groups, either via a dedicated portal or via threads on hacking forums.

RaaS portals work by providing a ready-made ransomware code to other gangs. These gangs, often called RaaS clients or affiliates, rent the ransomware code, customize it using options provided by the RaaS, and then deploy in real-world attacks via a method of their choosing.
Payments from these incidents, regardless of how the affiliates managed to infect a victim, go to the RaaS gang, who keeps a small percentage and then forwards the rest to the affiliate.
Click to expand...

The RaaS tiers
According to a report published today by Intel 471, there are currently around 25 RaaS offerings being advertised on the underground hacking scene.

Tier 1 is for the most well-known ransomware operations today. To be classified as a Tier 1 RaaS, these operations had to be around for months, proven the viability of their code through a large number of attacks, and continued to operate despite public exposure.
This tier includes the likes of REvil, Netwalker, DopplePaymer, Egregor (Maze), and Ryuk.

Tier 2 is for RaaS portals that have gained a reputation on the hacking underground, provide access to advanced ransomware strains, but have yet to reach the same number of affiliates and attacks as Tier 1 operators.
This list includes the likes of Avaddon, Conti, Clop, DarkSide, Mespinoza (Pysa), RagnarLocker, Ranzy (Ako), SunCrypt, and Thanos — and these are effectively the up-and-comers of the ransomware world.
Click to expand...

Tier 3 is for newly launched RaaS portals or for RaaS offerings about which there's limited to no information available. In some cases, it is unclear if any of these are still up and running or if their authors gave up after trying and failing to get their portals off the ground.
This list currently includes the likes of CVartek.u45, Exorcist, Gothmog, Lolkek, Muchlove, Nemty, Rush, Wally, Xinof, Zeoticus, and (late arrival) ZagreuS.

All in all, while the underground cybercrime ecosystem is generating profits through criminal activity, it is still a market, and, just like all markets, it is governed by the same principles that guide any other market today.
Click to expand...

Intel 471: Ransomware-as-a-service: The pandemic within a pandemic

What is known is that the criminal groups behind ransomware are flourishing, creating new variants and offering access on underground markets to anyone that has access to corporate networks and a desire to make a substantial amount of illicit money.
The following is an examination of Ransomware-as-a-service (RaaS) crews that have grown over the past year. This is not meant to be a definitive measure of the ransomware scene, as what could be considered “damaging” — payment amount, system downtime, communications with attackers — could vary by crew or incident.
Click to expand...

guest · Nov 27, 2020

The Emerging Ransomware-As-A-Service Economy
November 27, 2020
https://www.forbes.com/sites/robertvamosi/2020/11/27/the-emerging-ransomware-as-a-service-economy/

The more stolen credit cards and social security numbers that you monetize on the criminal underground forums, the lower the value of that data.

"That is not the case with ransomware," Jason Rivera, Director, Strategic Threat Advisory Group at CrowdStrike, explained.
"With ransomware, it is the exact opposite. The more ransomware attacks that occur, the more they succeed, the more the victims pay, other ransomware operators are like, 'Oh yeah, I can do that too? How would I get into this game?'"
Ayers gave two examples of Ransomware as a Service (RaaS) that she's seen in recent months. These are examples of Big Game Ransomware, where the attacks are deliberate and calculated not scattershot as some of the earlier ransomware attacks.
Click to expand...

The first case, which CrowdStrike dubbed "Circus Spider," primarily targeted the energy sector.

"The actor in this case performed host reconnaissance and an environment in preparation for operation readiness to begin to deploy that ransomware," Ayers said.
A second example, dubbed "Pinchy Spider", one of the more predominant distributors of Revil ransomware. "They've set up a really nice business model," Ayers said, "because of the success that they've had in building up this package effectively to give these operators the ability to distribute to execute, to claim, and to subsequently feed back into the system. [...]"
Click to expand...

guest · Nov 28, 2020

Botnet Operators Ditch Banking Trojans for Ransomware
Profits Drive Demand for Initial Access Brokers, Affiliates
November 25, 2020
https://www.bankinfosecurity.com/botnet-operators-ditch-banking-trojans-for-ransomware-a-15455

Driven by the profits to be achieved via ransomware, most botnet operators have dropped banking Trojans in favor of supporting and running crypto-locking malware attacks, according to security experts who spoke Wednesday at cybersecurity firm Group-IB's CyberCrimeCon 2020 virtual conference.

The volume of ransomware attacks continues to rise. Security experts say ransomware operators continue to innovate, lately including the creation of sites for naming-and-shaming victims and leaking or auctioning stolen data (see: Data-Exfiltrating Ransomware Gangs Pedal False Promises).
Click to expand...

Ransomware Operators Tap Affiliates
During the conference, Group-IB reviewed recent cybercrime trends and reported that ransomware gangs have been increasingly adopting affiliate programs. These involve ransomware operators building attack code and infrastructure, then recruiting affiliates to plant the malicious code on systems. Every time a victim pays, affiliate and operator share the profits (see: More Ransomware-as-a-Service Operations Seek Affiliates).
Botnet Operators Drop Banking Trojans
Another measure of ransomware's success is that the four largest banking botnets run by Russian speakers - Trickbot, Dridex, Qbot, and Silent Night - all shifted from banking malware to crypto-locking malware, Group-IB says.
Click to expand...

Rise of the Initial Access Brokers
Fueling the growth in ransomware attacks has been a marked increase in offerings from initial access brokers, which often run brute-force remote desktop protocol attacks to steal credentials that they sell to other criminals.

Group-IB says the sum of all prices for access information being offered by initial access brokers was about $1.6 million in 2018 and involved about 37 active sellers. By the first half of this year, the cumulative total had risen to $6.2 million, with 63 active sellers, of which 52 had only begun selling access credentials this year.
Click to expand...

guest · Dec 11, 2020

Mount Locker Ransomware Offering Double Extortion Scheme to Other Hackers
December 11, 2020
https://thehackernews.com/2020/12/mount-locker-ransomware-offering-double.html

The MountLocker ransomware, which only began making the rounds in July 2020, has already gained notoriety for stealing files before encryption and demanding ransom amounts in the millions to prevent public disclosure of stolen data, a tactic known as double extortion.

"The MountLocker Operators are clearly just warming up. After a slow start in July they are rapidly gaining ground, as the high-profile nature of extortion and data leaks drive ransom demands ever higher," researchers from BlackBerry Research and Intelligence Team said.
"MountLocker affiliates are typically fast operators, rapidly exfiltrating sensitive documents and encrypting them across key targets in a matter of hours."
Click to expand...

Offered as Ransomware-as-a-Service (RaaS), MountLocker was notably deployed earlier this August against Swedish security firm Gunnebo.

"Since its inception, the MountLocker group has been seen to both expand and improve their services and malware," the researchers concluded. "While their current capabilities are not particularly advanced, we expect this group to continue developing and growing in prominence over the short term."
Click to expand...

BlackBerry: MountLocker Ransomware-as-a-Service Offers Double Extortion Capabilities to Affiliates

It is likely that the threat actors were negotiating with the MountLocker operators to join their affiliate program and obtain the ransomware during this pause. Upon obtaining the MountLocker ransomware, the threat actors were observed returning with several “public” tools, including CobaltStrike Beacon and AdFind from Joeware. Over a period of approximately 24 hours: [...]

Successful MountLocker affiliates have been known to seek multi-million-dollar payments for decryption services and to prevent public disclosure of stolen data. The MountLocker operators are currently hosting a site on the dark web where they announce their recent targets and supply links to leaked data.
Click to expand...

guest · Dec 16, 2020

Ransomware gangs automate payload delivery with SystemBC malware
December 15, 2020
https://www.bleepingcomputer.com/ne...omate-payload-delivery-with-systembc-malware/

SystemBC, a commodity malware sold on underground marketplaces, is being used by ransomware-as-a-service (RaaS) operations to hide malicious traffic and automate ransomware payload delivery on the networks of compromised victims.

The malware, first spotted in 2018 and used in several 2019 campaigns as a "virtual private network", has allowed ransomware gangs and their affiliates to deploy a persistent backdoor on the targets' systems in the form of a Tor SOCKS5 proxy.
Click to expand...

Used by both Ryuk and Egregor
According to information collected by Sophos researchers while investigating recent Ryuk and Egregor ransomware attacks, SystemBC has been deployed in all their attacks during the last months.

"We are increasingly seeing ransomware operators outsource the deployment of ransomware to affiliates using commodity malware and attack tools," said Sophos security researcher Sean Gallagher in a report shared in advance with BleepingComputer.
"SystemBC is a regular part of recent ransomware attackers’ toolkits— Sophos has detected hundreds of attempted SystemBC deployments worldwide over the last few months."
Click to expand...

"The use of multiple tools in ransomware-as-a-service attacks creates an ever more diverse attack profile that is harder for IT security teams to predict and deal with," Gallagher said.
Click to expand...

Sophos: Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor

A commodity malware backdoor, SystemBC has evolved into a Tor proxy and remote control tool favored by actors behind the latest high-profile ransomware campaigns.
All of these attacks appear to have been launched by affiliates of the ransomware operators, or by the ransomware gangs themselves through multiple malware-as-a-service providers. They involved days or weeks of time on the targets’ networks and data exfiltration
Click to expand...

guest · Jan 2, 2021

Ransomware attackers now have their sights set on the biggest prize
The business of ransomware is changing and the next targets are going to be wealthy organisations
January 2, 2021
https://www.wired.co.uk/article/ransomware-trends-2021

Ransomware is one of the fastest growing threats in cybersecurity, with global damages predicted to reach £15 billion by 2021, up from £262m in 2015. Attackers will in 2021 target companies under pressure from the post-pandemic economic recession and they are more likely to cave to ransom demands.

The business of ransomware is also changing. We are seeing actors ramping up demands – in some cases, seeking payment of one sum in five days, but then demanding more every few days after. Some groups charge an organisation to unlock access to its data, but also go on to sell data they have harvested, giving them a revenue “double dip”.
Attackers are also shrewd businesspeople, carefully pricing their demands so that paying them off is a rational, if unpleasant, commercial choice.
Click to expand...

In 2021, we will see an increased trend away from a “spray and pray” approach to ransomware attacks to ones known as “big-game hunting”. This is where attackers focus their efforts on victims that can yield a greater financial pay-off.
Click to expand...

guest · Jan 8, 2021

Ryuk Ransomware Attackers Have Made $150m
January 8, 2021
https://www.infosecurity-magazine.com/news/ryuk-ransomware-attackers-have/

The infamous operators of the Ryuk ransomware have amassed a fortune of at least $150m, according to researchers who studied the flow of Bitcoin to the group.

A new report from US threat prevention firm AdvIntel and UK-based threat intelligence vendor Hyas is based on analysis of 61 cryptocurrency deposit addresses linked to Ryuk.
Most of the digital currency the group collects is sent to Asia-based exchanges Huobi or Binance, which may help them to escape scrutiny, the report authors argued.

The team were also able to observe “significant flows” of Bitcoin to smaller entities. These are likely to be criminal enterprises set up to help launder funds into local currencies or other types of digital money.
Click to expand...

“With the limited visibility available to analysts, it is painfully clear that the criminals behind Ryuk are very business-like and have zero sympathy for the status, purpose or ability of the victims to pay,” the researchers continued.
Click to expand...

guest · Jun 21, 2021

LockBit Returns to the Ransomware Space With the Launch of a New Affiliate Program
June 21, 2021
https://www.technadu.com/lockbit-returns-ransomware-launch-new-affiliate-program/285105/

LockBit jumps to fill in the gaps left by the departure of popular RaaS, launching the ‘LockBit 2.0’.

The new RaaS program promises to offer the fastest encryption and data exfiltration available out there.

LockBit has gone through a period of inactivity in the past six months but has now identified an opportunity.

Click to expand...

[...] LockBit, who, according to KELA, have just announced the start of the LockBit 2.0 affiliate program. This is a call to all ransomware crooks out there to consider joining in and benefiting from a new toolset that is allegedly superior to anything else circulating out there.

First of all, LockBit 2.0 promises to offer the fastest data exfiltration in the market through a new tool called ‘StealBit,’ which also supports real-time compression and drag-and-drop functionality and remains hidden from security tools. Based on LockBit’s promise, it can download 100 GB of data from compromised systems in just under 20 minutes.

Stealing that data is the whole point of ransomware attacks today because this data is often the only reason victims pay the demanded ransom.
Click to expand...

Now, LockBit is launching a fresh RaaS program to lure in all those actors who have been using DarkSide, Clop, Avaddon, etc., hoping to gain some serious cash over the next couple of months.
Click to expand...

guest · Jun 26, 2021

Cybersecurity chief warns ‘ransomware as a service’ scam
June 26, 2021
https://www.irishtimes.com/business...-warns-ransomware-as-a-service-scam-1.4603745

The online security crowd don’t tend to downplay risk but a presentation by Lindy Cameron, chief of the UK national cybersecurity centre, was sobering nonetheless.
The organisation has dealt with more than 2,000 significant incidents since 2016. In the last year it took down more than 700,000 online scams.

Ms Cameron warned of “ransomware as a service” where unsavoury types offer ransomware variants and commodity listings – such as lists of credentials – for a once-off payment or a share of profits. This off-the-shelf fraud appears to have no limits, paving the way for non-tech gangsters to get in on the greed.

“Users buy from developers without the costs and risks of developing it themselves, and that enables actors less experienced in ransomware to acquire tools to conduct their own attacks.”
Click to expand...

Whatever happened the ordinary decent hacker?
Click to expand...

guest · Jun 29, 2021

Ransomware gangs now creating websites to recruit affiliates
June 28, 2021
https://www.bleepingcomputer.com/ne...-now-creating-websites-to-recruit-affiliates/

Ever since two prominent Russian-speaking cybercrime forums banned ransomware-related topics [1, 2], criminal operations have been forced to promote their service through alternative methods.

At least two ransomware gangs in need of hackers to run the attacks have been using their sites to advertise features of their encryption tools to attract new recruits.
Click to expand...

About a week ago, LockBit ransomware gang announced a new major version for their tool, claiming significant improvement for the encryption speed.
To attract partners, LockBit claims to offer the fastest encryption and file-stealing (StealBit) tools “all over the world.”

This move from LockBit comes after the actor in late May tried to get ransomware talks back on a popular Russian-speaking forum by proposing a private section only for “authoritative users, in whom there is no doubt.”
Click to expand...

Another gang promoting their ransomware-as-a-service (RaaS) operation on their website recently is Himalaya, an actor that started its activity this year.

Except for using their site to spread the word, Himalaya does not seem any different than other ransomware programs. They advertise a 70% commission for affiliates and an “already configured and compiled FUD [Fully UnDetectable]” file-encrypting malware.
As seen from the announcement below, Himalaya lays out a strict rule about the targets and apparently does not allow attacking healthcare, public, and non-profit organizations.

While BleepingComputer knows of just LockBit and Himalaya to actively advertise their RaaS operation on their websites at the moment, other ransomware gangs could adopt the tactic if it proves successful.
Click to expand...

guest · Jul 26, 2021

AvosLocker Ransomware Gang Recruiting Affiliates, Partners
Malwarebytes: Gang Seeking 'Pentesters' and 'Access Brokers'
July 26, 2021
https://www.databreachtoday.com/avoslocker-ransomware-gang-recruiting-affiliates-partners-a-17147

A recently discovered ransomware-as-a-service gang dubbed AvosLocker is recruiting affiliates and partners, including "pentesters" and "access brokers," on darknet forums, according to the security firm Malwarebytes.

The gang behind the AvosLocker ransomware variant was identified by independent security researcher Rakesh Krishnan in June. The gang apparently has targeted smaller law firms and freight, logistics and real estate companies in the U.S., the U.K. and parts of Europe over the last several months, Krishnan and other researchers note.
Click to expand...

Earlier this month, the AvosLocker gang apparently launched a ransomware attack against Geneva, Ohio - a city of 6,200 - according to WKYC, an NBC affiliate in Cleveland.

"There isn't much to know about AvosLocker at this point. They are very new, so they haven't had a lot of success. Their biggest success so far has been Geneva, Ohio," says Allan Liska, an intelligence analyst with Recorded Future's computer security incident response team. "They are still trying to recruit affiliates, but I am not sure there has been much uptake there. They are definitely worth continuing to monitor."
"They announced a recruitment for 'pentesters with Active Directory network experience' and 'access brokers', which suggests that they want to cooperate with people who have remote access to hacked infrastructure," according to Malwarebytes.
Click to expand...

The researchers also found the gang advertising its crypto-locking malware as a multithread ransomware variant written in the C++ programming language. For affiliates, the group offers data hosting and helps to negotiate the ransom, the report notes.

"They offer not only the malware, but also help in managing the communication with the victim, and hosting of the data stolen during the operation," according to Malwarebytes.
Click to expand...

Malwarebytes: AvosLocker enters the ransomware scene, asks for partners

Avos is a relatively new ransomware, that was observed in late June and early July. Its authors started searching for affiliates through various underground forums.
In the other advert they describe the product they offer: a multi-threaded ransomware written in C++:

They offer not only the malware, but also help in managing the communication with the victim, and hosting of the data stolen during the operation.
Click to expand...

This ransomware is dedicated to be deployed by the attacker manually on the hacked machines. This purpose is reflected in the design. In contrast to most malware, AvosLocker comes without any protective (crypter) layer. Yet, it’s not completely defenseless: all the strings, and some of the APIs, are obfuscated in order to evade static detection. Yet, during its execution, it yells out on the console the logs of the performed actions, so that the attacker could observe in the real time what the program is doing.
Click to expand...

EASTER · Jul 26, 2021

In a way all these ransonware intrusions are great! Teach a hard lesson that current software tech is coded very inaccurately to be depended on blindly with a scant few security program provisions and put those computer security firms to do real work and pay attention to their clients data safety. All i'm going to say about the matter.

Blame game is a guilty cheap cop out for their lack of enthusiasm.

guest · Jul 28, 2021

Russian-Speaking Forum ‘RAMP’ Fostering New RaaS Launches and Affiliates
July 28, 2021
https://www.technadu.com/russian-speaking-forum-ramp-fostering-new-raas-launches-affiliates/292147/

A new dark-web forum called ‘RAMP’ is looking to connect RaaS vendors with orphaned affiliates.

The forum has had an impressive start, then a spam-induced shutdown, and is scheduled to relaunch next month.

‘RAMP’ can serve as the “barometer” to determine if public RaaS programs still have a future.

Click to expand...

The dark web is an ever-evolving space with domains changing hands, platforms shutting down, actors disappearing, and new places emerging as the next big thing. Researchers at KELA, the cyber-intelligence expert who focuses on the identification of novel threats that originate from the darkest places of the web, have spotted a new forum named ‘RAMP.’ This is a place set up to allow ransomware affiliates to find “ethical” RaaS programs to join and vendors to reach out to interested actors.

According to the report that KELA shared with TechNadu prior to its publication, the admin of the RAMP forum, who currently uses the nickname “Orange,” announced it as a haven for the chased community that had no place to go after the REvil and DarkSide bans that took place on other notorious forums (‘Exploit’ and ‘XSS’). The site itself is hosted on a domain previously used by Babuk, but since the actor has previously claimed to have sold various things to other hackers, it is impossible to tell if he’s currently actively involved in this new endeavor.
Click to expand...

One notable case was a post by a LockBit admin who promised to launch the LockBit 2.0 ransomware version soon, almost a full month back.
During the first ten days of its operation, RAMP counted 350 registered users and over 100 posts. [...] one will have to cover the cost of $500 for a registration fee. This will ensure that only those who are serious about doing RaaS business will join RAMP, but it is well above the entry fee requested elsewhere.

If ‘RAMP’ makes it, it’ll mean that public ransomware as a service (RaaS) operations still have a future and that there are groups out there addressing the wider cybercrime community to make a profit.
Click to expand...

KELA: New Russian-Speaking Forum – A New Place for RaaS?

A new Russian-speaking forum called RAMP was launched in July 2021 and received much attention from researchers and cybercrime actors. The forum emerged at the domain that previously hosted the Babuk ransomware data leak site and later the Payload.bin leak site. KELA researched the contents of the new site and assessed its chances to succeed.

*All the forum contents are described based on what KELA observed on RAMP until July 27, 2021, when the access became was restricted.
Click to expand...

Log in or Sign up

Ransomware as a Service (RaaS) – The Business of Ransomware

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

Log in or Sign up

Ransomware as a Service (RaaS) – The Business of Ransomware

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

Useful Searches