The Rise of RaaS Ransomware-as-a-Service In this whitepaper we offer a primer on examples of ransomware development, and its impact along the attack lifecycle. We focus on averting negative organizational outcomes, including business interruption, data loss, and business impact. We offer ways you can reduce risk on your own, and make a case for incorporating AI-enabled, intelligent MDR into your cybersecurity strategy. We provide additional resources to help you achieve your goals. CONTRIBUTORS: Adam Mansour Sean Hittel Will Ehgoetz Certified Ethical Hacker & Distinguished Senior Head of Sales Engineering Security Engineer Threat Hunter 1 Introduction For decades, ransomware attacks The factors leading to this around the globe have grown in prediction are as follows: sophistication. As bad actors have reaped the profits of these crimes, i: Ransomware has been challenging to deal with since it began, and there’s no sign of that they have grown more organized changing. Ransomware itself is not a virus, so and competitive, operating in some it’s not what anti-virus protection looks for. ways like legitimate businesses, That means many preventive technologies remain ineffective in thwarting it. Ransomware or “criminal enterprises”, offering remains profoundly disruptive and has a “service.” At the same time, proliferated precisely because it works — they have also become more businesses will pay malicious actors to remove extortionate in their threats and it and release the ransomed data. demands to victims. ii. Changes to the distribution of ransomware and to the tactics used by ransomware actors have After surveying the cybersecurity increased both its availability and potential for harm. landscape for 2021 and beyond, we believe there will be a further iii. Changes to ransomware technology itself are escalation of ransomware in the making it more potent. Ransomware is now medium to long-term. potentially capable of being deployed in virtual, cloud, and containerized environments. We call this the rise of “Ransomware-as-a- Service” (RaaS). The goal of this whitepaper is to offer a primer on some examples of ransomware development, and its impact along the attack lifecycle. Our focus will be on helping you avert negative organizational outcomes, including business interruption, data loss, and business impact. We will offer some (at times, restrictive) ways you can reduce risk without machine-speed capabilities, and make a case for incorporating AI-enabled, intelligent MDR in your cybersecurity strategy. 2 | ActZero - The Rise of RaaS 2 A Brief History of Ransomware: A Timeline Over the past decades, there have been significant milestones that helped shape the technology, tactics, and marketplace of ransomware, leading to the rise of the increasingly business-minded RaaS actors we describe in this paper. Some of these notable events are as follows: 1989 THE FIRST ATTACK: Dr. Joseph L. Popp, an evolutionary biologist, released AIDS Trojan (also known as PC Cyborg) to 20,000 individuals and medical institutions via infected floppy disks disguised as legitimate AIDS education software. In reality, it was one of the earliest pieces of Trojan malware and the first known ransomware attack. AIDS Trojan encrypted C: drive file names, preventing users from accessing their files until they paid a “lease” to PC Cyborg Corp. in order to “renew” the so-called “software.” AIDS Trojan used symmetric encryption, making it relatively easy to decrypt, and Popp relied on a PO box to receive the extorted payments. Though rudimentary, this set the stage for decades of increasingly refined attacks. 1992 ANONYMIZING PAYMENTS: Sebastiaan von Solms and David Naccache published a paper titled “On Blind Signatures and Perfect Crimes.” They proposed how systems designed to “protect the identity and privacy of a user in electronic payment and service networks” might have prevented a kidnapper from being caught when he withdrew the ransom payment. Now, it’s common practice for criminals to demand payment in cryptocurrencies, especially Bitcoin. 1996 STRENGTHENING ENCRYPTION: Inspired in part by the damage AIDS Trojan might have caused had it not relied on weak symmetric encryption, Adam L. Young and Moti Yung published a paper called “Cryptovirology: Extortion-Based Security Threats and Countermeasures.” In it, they predicted the “potential threats and attacks that rogue use of [public-key] cryptography can cause when combined with rogue software.” 2005 EVOLUTION OF RANSOMWARE: May 2005 saw the release of Trojan.Gpcoder, considered by some to be the “first modern ransomware.” One news article from the era described “the swiftness and thoroughness” of an attack demanding $200. Over the following years, the intricacy of such operations would only increase, along with the price tag for complying with demands. ActZero - The Rise of RaaS | 3 With bad actors increasingly focused on the most lucrative 2011 A CRIMINAL MARKETPLACE: targets, the future of ransomware A dark web black market called Silk Road launched, could further turn toward attacks becoming the most sophisticated and extensive criminal marketplace on the Internet at the time. All aimed at the cloud, virtual manner of illicit goods and services were obtainable on the Silk Road. It became a clearinghouse for malware environments, and infrastructure- of all kinds, including password stealers, keyloggers, remote access tools, and ransomware. For the as-a-service (IaaS). first time, ransomware and its distribution became centralized and readily available to malicious actors lacking the programming abilities to design malware of their own. 2012 CUSTOMIZED ASSAULTS: Reveton was unleashed in the EU; infected computers locked out users and displayed a fraudulent message purporting to be from law enforcement. These communications were tailored to the location of individual users, and demanded they pay fines for fictitious crimes. Users were often alleged to have downloaded pirated software or child pornography. Some variants even displayed footage from a victim’s webcam to convince them they were being surveilled by police. This individualized approach was an early indicator of ransomware actors leveraging business tactics to further their illicit agendas. Also of note were the embarrassing (or worse) criminal accusations levied at victims, as this introduced a psychological element to ransom demands beyond the threat of denied access to files. 2013 END OF THE SILK ROAD: U.S. authorities shut down Silk Road, motivating the rise of cell-based hacking groups suddenly lacking a centralized marketplace in which to operate. This fragmentation paved the way for such groups to essentially “freelance,” offering Ransomware-as-a-Service. In 2020, Forbes reported that advanced cybercrime tools, “complete with free updates and technical support,” were readily available for lease on a variety of forums. The separation of ransomware creation from its infiltration and deployment now means a would-be cybercriminal doesn’t even “need to be a programmer to use these tools; they really are off-the-shelf packages.” 2015 PUNITIVE DOXING: Chimera was distributed via targeted emails or malicious links in phishing campaigns, especially to small companies. More than simple ransomware, Chimera was an example of “doxware” — beyond locking a victim’s files, Chimerathreatened to release (or “dox”) the files on the Internet if the ransom was not paid. This risk of data release was a marked escalation in the consequences of not meeting the demands of cybercriminals, and has since become common practice. In a bizarre twist that incorporated both industrial espionage and pyramid schemes, the creators of a subsequent ransomware program publicly released the keys to Chimera, in an effort to sabotage their competition. Taking another cue from legitimate business, these rivals offered a profit-sharing affiliate deal for people who distributed their new malware. 4 | ActZero - The Rise of RaaS 2017 RANSOMWARE AS CYBERWARFARE: NotPetya was used in a global cyberattack, primarily targeting Ukrainian banks, ministries, newspapers, and electricity firms. Other infections were reported in France, Germany, Italy, Poland, Russia, the United Kingdom, the United States, and Australia. While masquerading as ransomware, NotPetya could also completely wipe or rewrite files in a way that couldn’t be undone through decryption. NotPetya is especially notable because of the involvement of state-level actors using ransomware as a tool of cyberwarfare. Security researchers, Google, and the U.S. and Canadian governments laid the blame for the NotPetya attacks at the feet of the Russian government, who allegedly operated through the Sandworm hacking group of Russia’s military intelligence service, the GRU. 2018 FURTHER EVOLUTION: Though first discovered in 2014, the Emotet malware continues to be one of the most pervasive cybersecurity threats in the wild, and one that has evolved from a simple banking Trojan to a platform for distributing other kinds of computer viruses. In 2018, a new variant of Emotet appeared that included the ability to install other malware to infected machines, such as the Ryuk ransomware, which came to prominence beginning in 2018. Massive outbreaks of Emotet in late 2019 and throughout 2020 have led the U.S. Department of Homeland Security to classify Emotet as one of the most costly and destructive malwares active today, affecting governments, businesses, organizations, and individuals. Incidents cost bigger targets like SLTT governments