Tradecraft Tuesday | How Ransomware-as-a-Service Fits in the Ransomware Economy

The ransomware economy has evolved from single-group operations to a segmented RaaS model, where diverse affiliates use varied tactics to deploy identical malware, creating significant attribution challenges for defenders.

Key Takeaways:
• Ransomware is now a segmented economy with RaaS providers, access brokers, and affiliates, lowering the barrier to entry for attackers 09:15
• Media reports often misattribute attacks to specific "groups," but different affiliates using the same RaaS tool exhibit distinct TTPs and IOCs 18:45
• "Double claims" occur when affiliates maintain persistence in a victim environment to deploy multiple ransomware variants from different providers 14:20
• Initial access vectors vary widely (RDP, RMM, phishing), meaning defenders cannot assume uniform entry points even when the same ransomware is detected 22:10
• Effective defense requires rigorous asset inventory, attack surface reduction, and thorough incident investigations to identify actual persistence mechanisms 28:00

Understanding the modular nature of the RaaS ecosystem is critical for accurate threat detection and response, as the tool used no longer defines the attacker's identity or methodology.

Sources:

• 00:00 Introduction to TradeCraft Tuesday and ransomware as a service
• 04:30 News segment on Hanover County Schools and historical context
• 09:15 Evolution of the ransomware economy and segmentation
• 14:20 Explanation of "double claims" and affiliate persistence
• 18:45 The categorization problem and affiliate diversity in Killnet
• 22:10 Varied initial access and deployment tactics by affiliates
• 28:00 Defense recommendations and closing remarks