Ransomware as a service (RaaS) – what it is and how it works

Ransomware as a service (RaaS) is the business model behind most ransomware attacks today: one criminal group develops the program and the attack infrastructure, while “affiliates” rent them, attack companies and split the ransom with the developers. When we wrote this article, in May 2021, RaaS was a fast-growing phenomenon. Since then it has become the rule, not the exception.

Ransomware is a type of malicious software (malware) that, once it reaches the victim’s workstation, locks the data and demands payment to recover it. It uses advanced encryption functions to “password-protect” the information on the infected workstation. To get it back, victims are told to pay a sum of money, usually in cryptocurrency, most often in Bitcoin. Today, most groups first steal the data and only then encrypt it, so they can also threaten to publish it (double extortion).

How does RaaS work?

“Ransomware as a service” offerings let anyone with malicious intent launch ransomware attacks without the technical skills needed to write the program. The service’s developers provide the program, the control panel, the site where the payment is negotiated and sometimes even “support” for affiliates. In return, they earn a percentage of the ransoms victims pay.

According to a report by the security company Group-IB, almost two-thirds (64%) of the ransomware attacks analyzed in 2020 were carried out through RaaS services, and 15 new RaaS programs appeared that same year.

An affiliate doesn’t even need to break into the network themselves: they can buy already stolen access from other criminals, such as VPN or Remote Desktop passwords. In practice, anyone with access to the company’s internal network can become a vulnerability: in 2021, the LockBit group even started looking for employees willing to open up access to their company’s network in exchange for a share of the ransom.

IT security: tell me more →

What should a company do to protect itself from ransomware as a service attacks?

The most effective defense strategy against ransomware attacks is a combination of staff education, technical defenses and continuous monitoring of your infrastructure to detect vulnerabilities. In practice, a company needs to:

• protect all external access with two-step verification;
• use a high-performance security solution;
• have a high-performance backup solution, with a copy that attackers can’t delete;
• configure its firewall correctly and update the equipment at the edge of the network;
• train employees so they can identify malicious emails and files.

Let’s take these one at a time.

• Two-step verification on all external access. Many RaaS affiliates get into the network with stolen or guessed passwords for VPN, Remote Desktop or email. With a second factor, a stolen password is no longer enough. See also the basic rules for creating secure passwords.
• A high-performance security solution gives the workstation an extra layer of protection. Modern (EDR) solutions recognize typical ransomware behavior, such as rapidly encrypting many files, and stop the process before it compromises users’ information. We recommend a solution that can be managed centrally from a cloud console, and whose alerts someone actually follows up on.
• A high-performance backup solution, plus a fast restore procedure. Backup is the only reliable way to recover your data without paying. To survive an attack, at least one copy must be kept outside the company network or be impossible to change or delete (immutable backup), and restores must be tested regularly. Backup doesn’t prevent stolen data from being published, though, so it doesn’t replace the other measures.
• Configuring the company firewall correctly. Good security practice is to disable, at the firewall level, every service the company doesn’t need. In addition, the firewall, router and VPN server must be updated as soon as the manufacturer releases a security fix, because vulnerabilities in this equipment are among attackers’ favorite entry points.
• Securing the services users rely on. If, for example, Remote Desktop is used to access the office infrastructure, it must not be exposed directly to the internet, not even on a port other than the default one. Access goes through a VPN or a gateway with two-step verification, and only for users who need it.
• User training. Users need to be kept informed at all times on how to identify phishing emails and to be careful before opening email attachments or other files.

Backup as a Service: tell me more →

What do you do if your company is attacked?

If your company is attacked, immediately disconnect the affected computers from the network, without shutting them down, and call your IT team. Then:

• Don’t pay the ransom. This is also the recommendation of DNSC (the Romanian National Cybersecurity Directorate): paying doesn’t guarantee that you’ll get your data back or that it won’t be published, and it funds the next attacks.
• Report the incident. Any company can report an incident to DNSC on the single number 1911. Companies that fall under NIS2 (transposed in Romania by GEO 155/2024) send an initial notification within 24 hours of becoming aware of a significant incident and a full notification within 72 hours. If personal data has been affected, ANSPDCP (the Romanian data protection authority) must be notified within 72 hours, under the GDPR.
• Look for a free decryptor. For some ransomware families there are free decryption tools, published on No More Ransom, the project run by Europol and its partners.
• Restore from backup only after you’ve found out how the attackers got in and closed that access. Otherwise, the attack may happen again.

Examples of ransomware as a service (RaaS)

The examples below are groups that were active in 2021, when we wrote this article, along with what happened to them afterwards.

DarkSide

DarkSide was a RaaS operation associated with a criminal group tracked by CrowdStrike as CARBON SPIDER. DarkSide’s operators initially focused on Windows computers and later expanded to Linux, targeting enterprise environments running unprotected VMware ESXi hypervisors or stealing vCenter credentials.

On May 10, 2021, the FBI publicly confirmed that the Colonial Pipeline incident involved the DarkSide ransomware. It was later reported that about 100 GB of data had been stolen from the Colonial Pipeline network, and the company confirmed it had paid $4.4 million to a DarkSide affiliate. The group announced it was shutting down in May 2021, shortly after the attack, and in June 2021 the US Department of Justice announced it had recovered part of the ransom, about $2.3 million in bitcoin.

REvil

REvil, also known as Sodinokibi, was sold by the criminal group PINCHY SPIDER under the affiliate model, with the group usually taking 40% of the profits. In 2021, REvil was behind some of the largest ransom demands up to that point: $50 million from Acer and $70 million after the July attack on Kaseya VSA, a remote management application used by IT companies, through which their clients’ businesses were hit in a chain reaction. The lesson for any company: your IT provider’s remote access must be protected as well as your own accounts.

Like TWISTED SPIDER, PINCHY SPIDER warned victims about the planned publication of their data, usually through a post on its data leak site (DLS) containing data samples as proof, before publishing most of the data after a set period of time. REvil also included a link to the blog post in its ransom note. This link displayed the victim’s data before it was made public, and visiting it started a countdown, after which the data was published.

In November 2021, as part of the international operation GoldDust, Romanian authorities arrested two suspects believed to be REvil affiliates. In January 2022, Russia’s security service (FSB) announced it had dismantled the group.

Dharma

CrowdStrike attributed Dharma ransomware attacks to a financially motivated Iranian group. This RaaS has been available on the dark web since 2016 and is mainly associated with attacks through the Remote Desktop Protocol (RDP). Attackers usually demanded 1–5 bitcoins from targets across a wide range of industries. Unlike REvil and other RaaS kits, Dharma isn’t centrally controlled.

Dharma variants come from multiple sources, and in most of the incidents where CrowdStrike identified Dharma, the files analyzed were almost identical. The only differences were the encryption keys, the contact email and a few other elements that can be customized through a RaaS portal. Because Dharma attacks are so similar, specialists can’t learn much from an incident about who is behind it and how they operate.

LockBit

In development since at least September 2019, LockBit was offered as RaaS to Russian-speaking users, or to English speakers who had a Russian-speaking guarantor. In May 2020, an affiliate operating LockBit posted a data leak threat on a popular Russian-language criminal forum. Along with the threat, the affiliate provided proof, such as a screenshot of a document from the victim’s data. Once the deadline passed, the affiliate would post a mega[.]nz link for downloading the stolen data. This affiliate threatened to publish the data of at least nine victims.

In the following years, LockBit became one of the most active RaaS operations in the world. In February 2024, in the international Operation Cronos, the UK’s National Crime Agency (NCA), the FBI and Europol took control of the group’s infrastructure and obtained more than 1,000 decryption keys.

A RaaS attack in Romania: the hospitals, in February 2024

Romania hasn’t been spared either. On the night of February 11 to 12, 2024, an attack with the Backmydata ransomware, from the Phobos RaaS family, took down a management information system used by several hospitals across the country. The attackers demanded a ransom of 3.5 bitcoins, and DNSC recommended that it not be paid.

Attackers increasingly target critical infrastructure and supply chains: energy, food, transport, public services, healthcare. These organizations can only afford a very short outage and are therefore more tempted to pay. The lesson is the same for any company, though: without a backup kept separate from the network, the only “solution” left is to pay.

Anyone who thought ransomware was losing ground was wrong: the battle has moved to the next level.

See also our article on popular types of malware and how to protect yourself from them.

Contact us for a free IT audit, through which we can give you tailored recommendations for protecting your company’s data.

RezolvIT is a managed IT services company in Bucharest, ISO/IEC 27001 certified, that provides personalized IT support to the companies it works with, whether it’s IT security, securing laptops used at home or employees working remotely. We also offer support with NIS2 compliance.