Ransomware attacks have evolved both technologically and organizationally as threat actors attempt to broaden the scope of their operations and increase profitability. Ransomware as a Service (RaaS) has been a pivotal force behind the rising frequency and complexity of ransomware attacks. The RaaS model which operates much like SaaS, and involves selling or renting ransomware capabilities to buyers, has lowered the entry threshold for the extortion business. Today, this is a well-oiled business model with multiple operators viz., Operators, Affiliates and Initial Access Brokers (IABs) – all working in unison to orchestrate the attack.
Within the realm of RaaS, one crucial player has emerged as a key facilitator: the IAB. IABs are individuals or groups that specialize in gaining unauthorized access to internal networks and systems, which they then sell to ransomware operators. Their responsibilities include identifying vulnerabilities, breaching network defences, and providing access to lucrative targets. IABs provide an option for attackers to conduct targeted attacks as they can choose from the spread of access posted by IABs in underground forums. SISA has observed noticeable changes in the modus operandi of IABs in the recent past, based on findings from incident response activities and forensic readiness audits. SISA’s annual cybersecurity report – SISA Top 5 Forensic-driven Learnings 2023-24, presents a deeper understanding of evolving tactics and intrusion methods of IABs.
Some of the prominent trends are discussed below:
The role of IABs in the realm of RaaS is continuously evolving. By understanding their shifting tactics, methods, and trends, organizations can better prepare themselves to mitigate the risk and impact of ransomware attacks. As IABs remodel their strategies, it is crucial for organizations to adopt robust security measures. Strengthening supply chain security, implementing multi-factor authentication, deploying advanced threat hunting solutions, and conducting regular training, are key steps to mitigate the threat of IABs.
Customer Success Stories
SISA Radar – Data Discovery and Classification Tool
Fast | Accurate | Reliable
Get Daily Updates on our Latest Threat Advisories