Ransomware-as-a-Service (RaaS) is flourishing at a pace like never before. We know what ransomware is. It is a malicious piece of code that locks you out of your computer. Hackers blackmail you into paying a certain amount of money as a way to regain access to your data. They also threaten to make the sensitive data public if you refuse to pay the ransom. That is essential what ransomware is. Then comes Ransomware-as-a-service (RaaS) that maximizes the problem to a significant extent.
What is Ransomware-as-a-Service?
As the name suggests, in Ransomware-as-a-Service (Raas) campaigns, Ransomware operators encourage other small hacking groups into using their piece of code to further the attack. In return, they split the ransom. It is a classic service-based approach that increases the volume of ransomware attacks in a small time frame.
According to a fresh report from a cybersecurity company Intel 471, around 25 active ransomware-as-a-group campaigns are lurking around, including the likes of REvil, Netwalker, DopplePaymer, Egregor (Maze), and Ryuk.
“Intel 471 has been tracking over 25 different ransomware-as-a-service crews over the past year, ranging from well-known groups that have become synonymous with ransomware, to newly-formed variants that have risen from the failures of old, to completely new variants that may have the ability to unseat the current top-level cabals,” said the report.
The report further examines how Ransomware-as-a-service (RaaS) groups have grown over the past year. These groups have also been classified as Tier 1 (Most wanted), Tier 2 (Rising), and Tier 3 (Emerging).
List of Tier 3 RaaS groups
- CVartek.u45
- Exorcist
- Gothmog
- Lolkek
- Muchlove
- Nemty
- Rush
- Wally
- XINOF
- Zeoticus
List of Tier 2 RaaS groups
- Avaddon
- Conti
- Clop
- DarkSide
- Pysa/Mespinoza
- Ragnar
- Ranzy
- SunCrypt
- Thanos
List of Tier 1 RaaS groups
- DopplePaymer
- Egregor/Maze
- Netwalker
- REvil
- Ryuk
In August, we saw Avaddon ransomware making the headlines for its scare tactics. In a RaaS campaign, Avaddon operators had launched a website to leak the stolen data of victims who fail or refuse to pay a ransom demand.
