Exploring Factors Affecting Ransomware-as-a-Service Proliferation - Lehtoniemi, Matti (2025)
Ransomware-as-a-Service (RaaS) has emerged as a model that democratizes access to attack tools and enables a broader range of individuals to participate in malicious activities. This study examines how these platforms operate on the dark web, focusing on their accessibility, offerings, and business strategies by employing theory-driven content analysis on ten ransomware sites. With insights from this, the research identifies factors driving proliferation and highlights implications for developing more effective countermeasures. Findings reveal that RaaS platforms are not only easily accessible but are also designed with a strong emphasis on marketability. They aim to entice affiliates with professional user interfaces, features, and branding that surprisingly prioritizes trust and legitimacy over technical details. Tactics leveraged range from using victims as living proof of powerful tools to always making sure operators are available for contact. Despite this apparent openness, selective vetting processes are still incorporated to ensure that only qualified affiliates gain access, maintaining operational integrity and mitigating the risk of misuse. This balance between openness and control suggests that RaaS operators strategically curate their user base to foster a reliable and efficient network important in supporting their operations and the business model as a whole. The study highlights how challenges posed by RaaS extend beyond technical vulnerabilities, encompassing economic, psychological, and sociological dimensions. This underscores the need for future defence strategies to consider the broader human factors and market dynamics in addition to the technical countermeasures previous research has largely focused on.