Notable Ransomware as a Service Campaigns

An example of a ransomware as a service operation that has gained notoriety of recent is the Satan RaaS Platform, which is available over the dark web and enables customers to launch customizable ransomware attacks at wide scale. Interested cyber attackers with minimal to no technical skill are able to subscribe to the Satan platform and launch their own attacks on their targets, all for a 30% cut of their gains paid to its creators.

Other strains of ransomware notable for being offered as a service include Petya and Cerber, the latter of which netted its creators $78,000 (at their standard 40% commission rate) in July 2016 on a total of $195,000 paid in ransoms – that’s a cool $117,000 for the attackers, who had to do little more than log in to Cerber’s platform and deploy the attacks. The authors of Cerber go as far as to advertise their RaaS offerings to prospective customers via banner ads and forum postings on the dark web, an indication of the organizational scale at which many of these campaigns are operating.

Last month the Fortinet Blog wrote about another ransomware as a service scheme dubbed Dot, which boasts sophisticated operations including a professional website, customer portal, and a commission rate of 50% for its authors.

Protecting Against Ransomware as a Service

While RaaS is expected to fuel an explosion in ransomware attacks, the defenses against RaaS are no different from the defenses against typical ransomware attacks. In a previous post on this blog, Juliana de Groot offers 8 tips for ransomware protection:

• Back up your files regularly and frequently: having diligent data backup processes in place can limit the damage caused by a ransomware attack significantly, as encrypted data can be restored without paying a ransom.
• Complete operating system and any software updates as soon as possible: software updates typically contain patches for security vulnerabilities and should be installed as soon as they’re made available. Enable automatic updates whenever possible to streamline this process.
• Do not click on email attachments or links from unconfirmed sources: email is a popular medium for phishing attacks that distribute ransomware or other malware via infected attachments or links to malicious websites.
• Disable Autorun for all mounted devices: disabling autorun will prevent malware from being able to spread autonomously, an important step in containing malware should an infection occur.
• Disable macro content in Microsoft Office applications: in many cases ransomware is spread via infected Microsoft Office documents that contain malicious macros that will download and execute the malware once run. Disabling macros by default can help to prevent compromises even if an infected file is opened by a user.
• Disable remote desktop connections when possible: disabling this feature will prevent attackers or malware from being able to access users’ devices and files remotely.
• Only log in as an administrator for as long as necessary: limit administrator privileges and the use of admin accounts whenever possible to ensure that a user that has been compromised isn’t inadvertently granting administrative privileges to an attacker who has gained access to their account.
• Deploy security software to bolster ransomware protection: there are a variety of solutions that can help prevent ransomware infections. At the bare minimum, antivirus solutions and firewalls can help to block known, common malware strains. For additional protection, companies should consider advanced threat protection solutions to improve ransomware detection and blocking capabilities.