A few years ago you could hardly open the tech press without reading about new service offerings — software-as-a-service (SaaS), platform-as-a-service (PaaS) and so on. We don’t hear these expressions quite so often today, simply because these services are now familiar, well-established features of the IT ecosystem.
But there is one fast-growing technology that IT professionals need to know about — and be on guard against. Call it cybercrime-as-a-service (CaaS). Bad actors no longer need to rely on their own abilities and resources to carry out exploits. An expanding range of tools and technologies, from exploit kits to ransomware, are available to help cybercriminals build threats and launch attacks.
Cybercrime-as-a-Service Explodes Onto the Scene
According to CIO Insight, a threat index created by network control solution provider Infoblox showed that cybercrime-as-a-service is growing at an explosive pace. The DNS Threat Index measures the number of malicious websites relative to a baseline average from 2013 to 2014.
With this baseline defined as 100, the index for the most recent reporting period, the first quarter of 2016 stands at 137. It stood at 128 in Q4 of 2015, representing an impressive growth rate of 7 percent over a single quarter.
These malicious sites offer a wide range of services for cybercriminals to leverage. Exploit kits that automate the development and delivery of malware are a well-established industry. The now-defunct Angler exploit kit was the industry leader, although an older exploit kit, RIG, has undergone a new surge in popularity.
Ransomware Goes Big Time
The hottest growth segment in cybercrime-as-a-service is ransomware, a technique that uses encryption technology to deny victims access to their own data until they pay up. The number of ransomware domains tracked in the DNS Threat Index has increased 35 times from its baseline value.
Ransomware has hit the big time — not just in the sheer number of malicious websites involved, but also in the scale of attacks and the nature of the targets. Ransomware used to be associated with small-scale attacks aimed largely at consumers or small businesses. Now, enterprise-strength ransomware attacks can target even the largest organizations.
Download the complete Ransomware Response Guide from IBM X-Force
Cybercrime as a Global Threat
Until this year, the majority of malicious domains were registered in the U.S., including both domains created for cybercrime and previously legitimate domains hijacked by bad actors. U.S.-registered domains still account for the largest share of new malicious domains (41 percent).
But five other countries now account for half of new malicious domains: Portugal, Russia, Netherlands, the U.K. and Iceland. These countries’ web presences share little in common beyond being favorites of the cybercrime-as-a-service industry, which is clearly adept at shifting resources at will.
For prospective targets such as you and your organization, there is no difference between attackers who leverage CaaS tool and those who use their own resources. If there is a specific lesson to be learned, it is that cybersecurity cannot be provided in isolation but must draw on cooperation to build a defensive system as flexible and powerful as the fast-growing cybercrime ecosystem.