Study shows 58% of malware families sold as a service are ransomware

Muscat: Nearly 58 percent of malware families sold as a service are ransomware according to a new study.
The Kaspersky Digital Footprint Intelligence team presented a new study that reveals ransomware as the most widespread Malware-as-a-Service (MaaS) over the past seven years.

The study is based on research conducted on 97 malware families distributed on the dark web and other resources. Additionally, the researchers found that cybercriminals often lease info stealers, botnets, loaders, and backdoors to carry out their attacks.

Malware-as-a-Service (MaaS) is an illicit model of business involving the leasing of software to carry out cyberattacks. Typically, clients of such services are offered a personal account through which they can control the attack, as well as technical support. It lowers the initial threshold of expertise needed by would-be cybercriminals.

Cybercriminals can 'subscribe' to Ransomware-as-a-service (RaaS) for free. Once they become partners in the program, they pay for the service after the attack happens. The payment amount is determined by a percentage of the ransom paid by the victim, typically ranging from 10 percent to 40 percent of each transaction. However, entering the program is no simple task, as it entails meeting rigorous requirements.

Nearly 18 percent of malware families being sold as a service proved to be botnets, loaders, and backdoors. These threats are combined into one group since they often have a common goal: to upload and run other malware on the victim’s device.

“For instance, the price of loader Matanbuchus tends to vary over time. The price in June of the current year starts from $4,900 per month. This type of malware is more expensive than infostealers, for example, the malicious code itself is more complex, and the operator provides all the infrastructure in this case – meaning the partners don't have to pay extra for bulletproof hosting services,” said Alexander Zabrovsky, Digital Footprint Analyst at Kaspersky.

“It is worth noting that the number of subscribers to Matanbuchus is very limited, allowing attackers to remain undetected for a longer time", he further added.

The cybercriminals who operate MaaS platforms are commonly referred to as operators, whereas those who purchase these services are known as affiliates. After closing a deal with operators, affiliates receive access to all necessary components of MaaS, such as command-and-control (C2) panels, builders (programs for quick creation of unique malware samples), malware and interface upgrades, support, instructions, and hosting. The panels are an essential component allowing attackers to control and coordinate the activities of the infected machines. For example, cybercriminals are able to exfiltrate data, negotiate with a victim, contact support, create unique malware samples, and much more.

Some types of MaaS, such as infostealers, allow affiliates to create their own kind of team. Members of such a team are called traffers – cybercriminals who distribute malware to increase profits and generate interest, bonuses, and other payments from affiliates. Traffers do not have access to C2 panels or other tools. Their only purpose is to scale up the spread of the malware. Most often, they achieve this by disguising samples as cracks and instructions for hacking legitimate programs on YouTube and other websites.

“Cybercriminals actively trade illicit goods and services, including malware and stolen data, over the shadow segments of the internet. By understanding how this market is structured, companies can gain insights into the methods and motivations of potential attackers. Armed with this information, we are able to better help businesses better develop effective strategies that prevent cyberattacks by identifying and monitoring cybercriminal activities, tracking the flow of information, and keeping up-to-date on emerging threats and trends”, added Alexander Zabrovsky.