Ransomware as a Service: Cybercriminals Embrace Commercialization

The Play ransomware strain, also known as Balloonfly and PlayCrypt, has transitioned into a Ransomware-as-a-Service (RaaS) operation, offering its services to other cybercriminals. Evidence suggests that affiliates who have purchased the ransomware are carrying out attacks using step-by-step instructions provided with the malware. The attacks exhibit little variation, including the use of the same tactics, passwords, and commands. Play initially targeted Microsoft Exchange Server vulnerabilities and dropped remote administration tools before deploying the ransomware. This shift to RaaS is expected to attract script kiddies and lead to a surge in ransomware incidents.