HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Malware as a Service Being Offered to Criminals on Darknet

You can choose a cloud-platform-as-a-service and software-as-a-service; however for the criminally minded, it is possible to purchase malware-as-a-service. Cybercriminals are now adopting the same business model to sell their malicious software as legitimate software vendors.

A platform or software-as-a-service is a business model that allows a product to be used, developed and managed by an individual or company; gaining the benefits of the software without having to develop everything from scratch.

Malware-as-a-service is available on the darknet and offers criminals the same benefits. In depth computer knowledge is not required; a criminal can select off-the-shelf malware to suit his or her needs. The creations of skilled hackers can be used by any number of relatively unskilled individuals to allow them to gain access to computers and networks and steal the valuable data they store.

Industry leaders are now referring to this mass-market malware sale as “the industrialization of cybercrime,” and it is a highly profitable business. It is so successful and profitable that sales are likely to grow and the volume of attacks will increase significantly.

Please see the HIPAA Journal Privacy Policy

The sale of malware in this way is particularly problematic for those tasked with protecting systems from attack, as well as for the FBI. At a recent security conference in London, FBI agent, Michael Driscoll, gave some insight into the criminal world of malware vendors and highlighted the dangers this approach bring.

There are, at the moment at least, a very limited group of individuals offering malware-as-a-service, which the FBI estimates to be approximately 200 individuals worldwide. These individuals offer hacking services and will carry out Denial of Service (DoS) attacks, produce malware on demand, create botnets as well as sell off-the-shelf malware. It is a lucrative business. In Russia alone the creation of Malware is believed to be generating approximately $2 billion per year.

Anyone looking to gain access to a network can contract phishing-as-a-service, or any other method of hacking provided the price is right. Since the cost of DoS attacks has fallen dramatically as other, more sophisticated methods of attack are now preferred, it is feared that criminals could start using DoS attacks again to mask another purpose. By taking up IT departments’ time dealing with relatively low-tech, but time-draining attacks, more sophisticated hacking attempts can be made simultaneously while attention is diverted.

As long as malware can be developed to exploit security vulnerabilities and sabotage systems, steal data or hold users to ransom, there will be a market for the malicious software. All that can be done is increase defenses against the malicious software.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.