Malware-as-a-Service: what you need to know about this persistent cyber threat

Think about how you approach tasks at work, or in your day-to-day life; it’s likely that you want to be as efficient as possible.  

Perhaps you’re using a generative AI tool like ChatGPT or Microsoft Copilot to save time making plans, or maybe you have a subscription to out-of-the-box software application that provides you with a ready-made set of the tools you need to accomplish a task efficiently and easily.

These suites and toolkits have become common across the modern enterprise and elsewhere and are used for legitimate, positive ends.  

But unfortunately, like they’ve done with many legitimate business tools and functions, threat actors have coopted these practices into their own operations, making them more efficient and more scalable. That means attackers are using these techniques to more easily find success with malicious cyber schemes. 

Perhaps the most notable example of this commoditization of cybercrime is the rise of Malware-as-a-Service (MaaS) and Ransomware-a-as-Service (RaaS) attacks.  These campaigns begin with more advanced threat actors who are happy to build and distribute plug-and-play malware kits to other less skilled threat actors. 

The kits, which are typically sold on dark web marketplaces, allow users to conduct malicious campaigns, be it installing information stealers or cryptominers onto machines, compromising networks with ransomware, roping unsuspecting users’ devices into botnets or all manner of other cyber crime. 

But whatever the distribution method, the pre-made MaaS kits are designed to be simple to use at every step of the attack process, from launching campaigns and infecting victims to cashing out at the end – and that makes MaaS a risk for organisations of all sizes. 

Ransomware-as-a-Service on the rise 

Perhaps the most significant example of the disruption that cybercrime ‘as-a-service’ schemes can cause is that of LockBit ransomware, once dubbed “the world’s most harmful cyber-crime group” by the UK’s National Crime Agency (NCA).  

LockBit gained a reputation as one of the most prolific variants of ransomware, used in thousands of attacks against targets around the world. High-profile victims included critical infrastructure providers and healthcare services – and even children’s hospitals.  

LockBit affiliates have made ransom demands of tens of millions of dollars for decryption keys and even in situations where victims didn’t pay, it’s estimated that LockBit attacks have cost billions of dollars in damage as victims have lost business due to downtime, along with restoring or rebuilding their IT infrastructure following attacks. 

 The internal operations of LockBit were exposed following a law enforcement takedown dubbed 'Operation Cronos' earlier this year – and it appears that the ringleader was willing to allow anyone who was willing to pay for the toolkit to use it. That sort of availability creates big problems for defenders.  

“Ransomware-as-a-Service operators want to allow their platforms to be used as widely as possible. They’re very happy to put into place what is necessary to allow these tools and techniques used as much of possible,” says Dr. Jason Nurse, Associate Professor in Cybersecurity at the University of Kent, where his research focuses on investigating how organizations, governments and individuals can enhance and maintain cybersecurity.

“The reality is these attackers are really skilled and they’re running these organisations like legitimate businesses,” explains Nurse, who is also an Associate Fellow at the Royal United Services Institute (RUSI), the world’s oldest defense and security think tank, having been founded in 1831.

AI-supercharged Malware-as-a-Service  

A common trait that users are often told is a telltale sign of malicious phishing emails is poor spelling and grammar, which could indicate the message has been created by someone who isn’t a native speaker of the language. 

However, the rise of generative AI tools and Large Language Models (LLMs) is a potential boon for threat actors, enabling them to craft more convincing phishing messages targeting specific companies or individuals, even if they don’t speak the same language.

Earlier this year, Microsoft and Open AI jointly published analysis on how nation-state backed threat actors working on behalf of governments – notably China, Iran, North Korea and Russia – have already been observed exploiting LLMs to aid malicious hacking and cyber espionage campaigns. Microsoft and OpenAI took joint action to disrupt the accounts being exploited by threat actors in these campaigns; but this is likely just the beginning of a lengthy battle ahead.

That reduction in time and effort is crucial for cyber criminals because ultimately, the aim of MaaS and RaaS campaigns is making money, be that the users deploying the toolkits against victims, or the developer of the service making money from subscriptions or profit-sharing  

And by deploying AI tools to help power these campaigns, threat actors can deliver more sophisticated attacks at a much greater scale, potentially affecting a deeper pool of targets, increasing their chances of success.