(huntress.com) Demystifying the Ransomware-as-a-Service Ecosystem: Why Branding Alone Fails to Explain Intrusion Tradecraft

[orlysec@swecyb.com]

(huntress.com) Demystifying the Ransomware-as-a-Service Ecosystem: Why Branding Alone Fails to Explain Intrusion Tradecraft

In brief - The RaaS ecosystem is far more fragmented than ransomware branding suggests. Initial access, persistence, and exfiltration vary widely even within the same ransomware family, driven by affiliates and IABs using diverse TTPs. Defenders must focus on intrusion chains, not just payloads, to mitigate risks effectively.

Technically - RaaS operations split roles: operators provide malware/infrastructure, while affiliates execute attacks via exposed RDP, vulnerable edge appliances (e.g., SonicWall VPNs), or rogue RMM tools (ScreenConnect, TeamViewer). Persistence includes hidden accounts or additional RMM installs. Evasion ranges from minimal obfuscation to BYOVD/EDR killers. Exfiltration leverages 7-Zip, MegaSync, RClone, or even finger.exe. Same ransomware (e.g., Qilin, Akira, LockBit) can deploy via disparate chains, complicating attribution. Prioritize monitoring TTPs over payloads for threat hunting.

Source: https://www.huntress.com/blog/raas-ecosystem-ransomware-tradecraft

#Cybersecurity #ThreatIntel