What is crimeware-as-a-service?

It seems that cybercriminals will never run out of clever and duplicitous schemes to defraud individuals and businesses out of their hard-earned money. Malicious online attacks, otherwise known as crimeware, have been on the rise for many years and 2020 was no exception; online attacks soared as cybercriminals took advantage of overwhelmed healthcare providers amidst the emerging coronavirus pandemic.  

Another offering that has enabled cybercriminals to scale their attacks, both in sophistication and frequency, is Crimeware-as-a-Service (CaaS). As CaaS continues to grow, healthcare providers must remain vigilant and take every precaution to safeguard their systems against all varieties of online attacks.  Crimeware-as-a-Service (CaaS) refers to any computer program or tool that allows criminals to facilitate illegal activities online. Drawing inspiration for its name from Software-as-a-Service (SaaS), CaaS allows cybercriminals with specialized backgrounds to sell their goods and services to other cybercriminals that may lack the know-how but have the funds to initiate an online attack. 

SEE ALSO : HIPAA Data Breaches Also Surge in the Age of Coronavirus

What types of CaaS do cybercriminals sell? 

Whether it’s email phishing kits, spyware, malware, keyloggers, or browser hijackers, the CaaS economy enables criminals to put their skills to use by allowing bad actors to purchase ready-to-go attack kits.  This spells danger for frequent targets of online attacks, such as healthcare organizations storing protected health information (PHI) and other valuable data.  Types of CaaS that can be bought online include:

• Ransomware-as-a-Service: Ransomware, one of the most significant threats to email security, is a type of malicious software that holds data hostage until the targeted victim pays a ransom to release it. Most commonly distributed via phishing attacks, ransomware email often comes from seemingly innocuous email addresses. With the availability of DIY ransomware kits on the black market, any cybercriminal can launch a large-scale ransomware attack on an unsuspecting organization. 
• Denial-of-service-attack-as-a-Service: A denial-of-service (DoS) attack is when a cybercriminal blocks access to a network, device, or site so that legitimate users cannot access it. DoS attacks are often launched against organizations for the purposes of blackmail, revenge, or to cause financial harm to the victim. DoS attacks offered as a type of CaaS allow hackers to rent their services, often for as little as $7 per hour. 
• Phishing-attacks-as-a-service: Email phishing attacks trick victims into revealing passwords, financial details, and other pieces of personal information in order to gain access to online accounts that have valuable data. Cybercriminals can easily purchase phishing kits, the back-end components of a phishing attack, to facilitate their own attacks. 

These are just a few types of CaaS available. While CaaS is by no means a new trend (According to the Malicious Code Research Center, CaaS has been noted by law enforcement as a growing problem since 2008), the continued commercialization of cybercriminal activities will undoubtedly continue to cause major problems for healthcare organizations. 

SEE ALSO : Healthcare Needs to Adjust to New Types of Cyber Attacks

The ability for even small-time hackers to purchase or rent the refined services of more experienced cybercriminals should alarm every company and organization. However, there is good news: While new cybercriminals may be joining the CaaS economy at a rapid clip, they’re not selling new attack services. For the most part, the CaaS attacks that cybercriminals are purchasing and launching are familiar to IT security teams.  Phishing attacks, spyware, DoS attacks, ransomware, and other types of online threats have been around for a long time. By now, most organizations are aware of how to protect against these threats with the help of services like Paubox Email Suite Plus.

How Paubox Can Protect against CaaS Attacks

The best way to protect your company against CaaS attacks is to start with a good defense. Paubox Email Suite Plus arms healthcare providers with robust inbound security technology to protect customers and employees from email cyberattacks and various types of online scams.  Many CaaS attacks rely on human error to succeed. However, Paubox Email Suite Plus mitigates this vulnerability with ExecProtect, which is patented protection that guards against display name spoofing attacks . It also allows patients to receive HIPAA compliant email without the use of a password or portal.