Cybercriminals Contemplate ‘Exploit-as-a-Service’ Model

Cybercriminals’ strategies may expand to include an “exploit-as-a-service” business model, report researchers investigating how attackers continue to exploit organizations’ weaknesses.

The Digital Shadows Photon Research Team collected evidence from cybercriminal markets and forums to better understand how vulnerabilities are bought and sold. They report some high-profile criminal groups, such as ransomware gangs, have amassed enough funds to compete with traditional buyers of zero-days — an expensive and competitive market, researchers note.

Their investigation revealed criminals discussing ideas for an exploit-as-a-service model that would “inevitably lower the barrier” for accessing these sophisticated exploits, the team wrote in a blog post.

“This model would allow capable threat actors to ‘lease’ zero-day exploits to other cybercriminals to conduct their attacks,” the report states. The benefit goes both ways: A developer can earn high profits when selling a zero-day exploit; however, it takes a lot of time to finalize a sale. This model would let developers generate even more earnings by renting out their exploits while waiting on a buyer.

“Additionally, renting parties could test the proposed zero-day and later decide whether to purchase the exploit on an exclusive or non-exclusive basis,” researchers noted.

Read more details here.