The Ransomware-as-a-Service economy within the darknet

TLDR

Ransomware, which forces individuals and companies to pay for data recovery, has spurred the rise of Ransomware‑as‑a‑Service (RaaS) franchises on darknet marketplaces that enable aspiring cybercriminals to participate in this illicit economy. The authors conducted a two‑year netnographic study of darknet markets and forums, producing a value‑chain model and actor descriptions of the RaaS economy. The study finds that RaaS poses a modest threat, with few offerings on darknet marketplaces that are often of questionable authenticity, contrary to popular belief.

Abstract

Ransomware is an epidemic that adversely affects the lives of both individuals and large companies, where criminals demand payments to release infected digital assets. In the wake of the ransomware success, Ransomware-as-a-Service (RaaS) has become a franchise offered through darknet marketplaces, allowing aspiring cybercriminals to take part in this dubious economy. We have studied contemporary darknet markets and forums over a period of two years using a netnographic research approach. Our findings show that RaaS currently seems like a modest threat relative to popular opinion. Compared to other types of illegal digital goods, there are rather few RaaS items offered for sale in darknet marketplaces, often with questionable authenticity. From our data we have created a value chain and descriptions of the actors involved in this economy.