Security News Malware creators increasingly run their business like legitimate software companies

[LASER_oneXM]

The continuing increase in ransomware attacks is, partly, due to how easy the malware can be built and used by attackers that have limited technical skills.

Take for example the Philadelphia Ransomware-as-a-Service (RaaS) offering. Offered for sale by a group (or individual?) that calls itself The Rainmakers Labs, it is just a part of the overall arsenal of “anti-security solutions” on offer

Philadelphia is a typical piece of crypto-ransomware and, as it’s usual with RaaS offerings, the buyer will get (almost) everything he or she needs to create a ransomware sample, set up a C&C server to communicate with victims, and manage the attacks.

For more technical information about the malware, you can check out this Sophos Labs report.

Malware sales techniques
But the most interesting thing about the group is their approach to marketing and sales.

“The Rainmakers Labs run their business the same way a legitimate software company does to sell its products and services,” the researchers explained.

“While it sells Philadelphia on marketplaces hidden on the dark web, it hosts a production-quality ‘intro’ video on YouTube, explaining the nuts and bolts of the kit and how to customize the ransomware with a range of feature options. A detailed Help Guide, walking customers through set-up is also available on a .com website.”

As expected, they advertise the malware on dark web forums and markets, but are also pushing it via other means. As noted by ClearSky Security earlier this year, they have been aggressively spamming potential buyers via the Jabber messaging platform.

They use brochures to explain the ransomware’s features, refer to news coverage and blog posts from security professionals as a means to show that their offerings are of good quality, and offer discounts or justify the high price ($389 for Philadelphia) by highlighting the lifetime access, constant updates and easy setup/usability of their product.

 

[Winter Soldier]

They act like a legit work, of course, it is a big real dirty business.