Malware-As-A-Service (MaaS).

What is malware-as-a-service?

Malware-as-a-service (MaaS) is a criminal business model in which the people who build malware sell or rent it to other criminals. The buyers use it without having to write it themselves. Europol describes one data theft tool that was sold as a service to other criminals, with clients paying a monthly fee in cryptocurrencies.

NIST defines malware as software or firmware intended to perform an unauthorized process that harms the confidentiality, integrity or availability of a system. MaaS is a way of selling that software.

How does malware-as-a-service work?

One group builds and maintains the malware. Other groups pay to use it. Europol also describes ransomware affiliate programs in a similar way. The group running the platform provides the tools, and affiliates use them in exchange for a percentage of the criminal proceeds they generate.

Europol says criminal services also support each other. Droppers are programs that deliver malicious software to a device. Europol says droppers offered as a service are used to deliver payloads such as information stealers, crypto-miners and remote access tools. Criminal groups running these services cooperate closely with other malware-as-a-service providers. They also work with crypter developers. Europol explains that crypters are software that hides and encrypts malicious code, which makes it less detectable by traditional anti-virus programs.

What does a malware-as-a-service attack look like?

This is a simple illustration, not a real case. One group sells access to a malware tool. A buyer sends it out through some intrusion method. Europol lists phishing emails that contain malware, brute forcing of Remote Desktop Protocol and exploitation of weaknesses in Virtual Private Network software as the most common intrusion tactics used by cybercriminals. Europol also says criminals usually gain initial access through compromised user credentials or by exploiting vulnerabilities.

ENISA, the European Union Agency for Cybersecurity, has documented an information stealer that has been available through a malware-as-a-service model on Russian-speaking forums since at least August 2022.

How can organizations reduce the risk?

Europol says criminals usually gain initial access through compromised credentials or by exploiting vulnerabilities, so general defenses still apply. CISA’s ransomware guide groups prevention advice by how attackers first get in. For internet-facing weaknesses, it advises not exposing services such as remote desktop protocol on the web, plus vulnerability scanning and timely patching. For compromised credentials, it lists phishing-resistant multi-factor authentication and credential monitoring services. For phishing, it lists user awareness training, email gateway filters and attachment filters. For malware infections, it lists anti-malware software with automatic updates, application allowlisting and endpoint detection and response.

Is malware-as-a-service the same as ransomware-as-a-service?

Not exactly. Ransomware-as-a-service is one form of the same idea, where the product is ransomware. Europol uses the phrase malware-as-a-service providers to include ransomware affiliate programs. MaaS is the wider term, because the malware sold can be of other types, such as information stealers. Related terms on this site include ransomware, infostealer and phishing-as-a-service.

Is malware-as-a-service part of cybercrime?

Europol describes these services as part of cybercrime. In one example in its report, a person suspected of creating and selling a data theft tool was arrested by Dutch authorities.