A few years ago you could hardly open the tech press without reading about new service offerings — software-as-a-service (SaaS), platform-as-a-service (PaaS) and so on. We don’t hear these expressions quite so often today, simply because these services are now familiar, well-established features of the IT ecosystem.

But there is one fast-growing technology that IT professionals need to know about — and be on guard against. Call it cybercrime-as-a-service (CaaS). Bad actors no longer need to rely on their own abilities and resources to carry out exploits. An expanding range of tools and technologies, from exploit kits to ransomware, are available to help cybercriminals build threats and launch attacks.

Cybercrime-as-a-Service Explodes Onto the Scene

According to CIO Insight, a threat index created by network control solution provider Infoblox showed that cybercrime-as-a-service is growing at an explosive pace. The DNS Threat Index measures the number of malicious websites relative to a baseline average from 2013 to 2014.

With this baseline defined as 100, the index for the most recent reporting period, the first quarter of 2016 stands at 137. It stood at 128 in Q4 of 2015, representing an impressive growth rate of 7 percent over a single quarter.

These malicious sites offer a wide range of services for cybercriminals to leverage. Exploit kits that automate the development and delivery of malware are a well-established industry. The now-defunct Angler exploit kit was the industry leader, although an older exploit kit, RIG, has undergone a new surge in popularity.

Ransomware Goes Big Time

The hottest growth segment in cybercrime-as-a-service is ransomware, a technique that uses encryption technology to deny victims access to their own data until they pay up. The number of ransomware domains tracked in the DNS Threat Index has increased 35 times from its baseline value.

Ransomware has hit the big time — not just in the sheer number of malicious websites involved, but also in the scale of attacks and the nature of the targets. Ransomware used to be associated with small-scale attacks aimed largely at consumers or small businesses. Now, enterprise-strength ransomware attacks can target even the largest organizations.

Download the complete Ransomware Response Guide from IBM X-Force

Cybercrime as a Global Threat

Until this year, the majority of malicious domains were registered in the U.S., including both domains created for cybercrime and previously legitimate domains hijacked by bad actors. U.S.-registered domains still account for the largest share of new malicious domains (41 percent).

But five other countries now account for half of new malicious domains: Portugal, Russia, Netherlands, the U.K. and Iceland. These countries’ web presences share little in common beyond being favorites of the cybercrime-as-a-service industry, which is clearly adept at shifting resources at will.

For prospective targets such as you and your organization, there is no difference between attackers who leverage CaaS tool and those who use their own resources. If there is a specific lesson to be learned, it is that cybersecurity cannot be provided in isolation but must draw on cooperation to build a defensive system as flexible and powerful as the fast-growing cybercrime ecosystem.

More from Data Protection

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them. ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge. Understanding Attack Surface Management Here…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor…

The Importance of Modern-Day Data Security Platforms

Data is the backbone of businesses and companies everywhere. Data can range from intellectual property to critical business plans to personal health information or even money itself. At the end of the day, businesses are looking to grow revenue, innovate, and operationalize but to do that, they must ensure that they leverage their data first because of how important and valuable it is to their organization. No matter the industry, the need to protect sensitive and personal data should be…

Meeting Today’s Complex Data Privacy Challenges

Pop quiz: Who is responsible for compliance and data privacy in an organization? Is it a) the security department, b) the IT department, c) the legal department, d) the compliance group or e) all of the above? If you answered "all of the above," you are well-versed in the complex world of compliance and data privacy! While compliance is a complex topic, the patchwork of regulations imposed by countries, regions, states and industries further compounds it. This complexity has turned…