Researchers investigating how attackers continue to exploit organizations’ weaknesses have reported that cybercriminals’ strategies may expand to include an Exploit-as-a-Service business model. The Digital Shadows Photon Research Team collected evidence from cybercriminal markets and forums to better understand how vulnerabilities are bought and sold. They report some high-profile criminal groups, such as ransomware gangs, have amassed enough funds to compete with traditional buyers of zero-days — an expensive and competitive market, researchers note. Their investigation revealed criminals discussing ideas for an Exploit-as-a-Service model that would “inevitably lower the barrier” for accessing these sophisticated exploits, the team wrote in a blog post. “This model would allow capable threat actors to ‘lease’ zero-day exploits to other cybercriminals to conduct their attacks,” the report states. The benefit goes both ways: A developer can earn high profits when selling a zero-day exploit; however, it takes a lot of time to finalize a sale. This model would let developers generate even more earnings by renting out their exploits while waiting on a buyer. “Additionally, renting parties could test the proposed zero-day and later decide whether to purchase the exploit on an exclusive or non-exclusive basis,” researchers noted.
Analyst Notes
Security teams can significantly improve their security posture with a few changes to their habits. For example, incorporating a risk-based approach to vulnerability management can help security teams navigate this sea of vulnerabilities. A framework based on the impact and likelihood of vulnerability exploitation can help mitigate some of the asset management challenges mentioned above. Making informed decisions requires contextual knowledge around the latest disclosed vulnerabilities. Identifying intelligence needs based on the organization’s threat model is therefore crucial to improve triaging and patching processes. Incorporating vulnerability intelligence will help prevent and quickly mitigate the most relevant threats for the organization. Once integrated into the threat model, vulnerability intelligence can be used across a variety of internal security functions, such as triaging threats, communicating them across the board, and mitigating them in a timely and accurate manner.
https://www.darkreading.com/threat-intelligence/cybercriminals-contemplate-exploit-as-a-service-model
