BlackBerry's Jonathan Jackson on Ransomware as a Service and Why Attacks Keep Growing

Organisations around the world have been dealing with ransomware for years. The global WannaCry outbreak brought it to mainstream attention several years ago, and since then it has been a persistent problem for companies in every industry. By 2021 there was no sign of the threat fading. If anything, it was getting worse.

This publication asked Jonathan Jackson, BlackBerry's director of engineering for APJ, what had changed. He explained that catastrophic data loss is no longer the only thing victims have to fear: attackers now also threaten to publish the data they have stolen in order to hurt the victim's brand.

Ransomware sold like software

Ransomware has also become easier than ever to launch, thanks to Ransomware as a Service (RaaS). Jackson describes RaaS as a new business model for the people who write ransomware. It works much like Software as a Service (SaaS): developers sell or rent out their variants to affiliates who lack the skills to carry out a sophisticated attack on their own.

Because it is simple and promises large payouts, RaaS is catching on. Jackson put it plainly: a would-be attacker can now pay someone else to run the attack, and that provider takes a share of whatever ransom is demanded. These services, he said, can be found free of charge on the deep web.

There are many highly capable, clever and well-funded groups operating. Hack-for-hire outfits and APT groups can quickly sell powerful toolsets that let individuals or organisations pull off a ransomware attack. That is how "easy" it has become.

The steady stream of hacks and data breaches makes things worse. Jackson noted that breaches typically produce stolen credentials, which are then sold on the deep web as well. Attackers exploit the fact that so many organisations have been breached. Getting hold of those credentials is very easy, he said, and once someone has them, a successful ransomware attack can follow.

Business leaders therefore need to know whether their own company is exposed. That means understanding the threats in circulation, the weaknesses that may exist in their systems and how to keep the company safe.

The pandemic treated as a vulnerability

During the pandemic, ransomware rose sharply, and so did phishing, spam and many other threats. Criminals are very good at exploiting weak points, and BlackBerry, notably, describes the COVID-19 pandemic itself as a vulnerability in security terms. Jackson said the company saw a spike in COVID-themed phishing campaigns, and in fake apps whose only purpose was to steal data from people who installed them.

BlackBerry also regards the demand for hack-for-hire groups as a growing threat. Jackson pointed to the BlackBerry Threat Report for 2021, which sets out a number of threat actors identified through the company's threat intelligence and research. Two of them are CostaRicto and Bahamut, groups he described as highly targeted in their efforts to steal data and break into systems.

Many people had hoped threats would calm down in 2021, he added, but BlackBerry is seeing the reverse. Zero-day attacks have increased recently, and organisations find them very hard to prepare for or defend against.

Where BlackBerry now sits

BlackBerry is moving away from its past as an electronic devices maker, and Jackson says the company has grown and now aims to "protect everything". By that he means anything connected to something else, a connected car for example. BlackBerry is heavily invested in cars, he said, specifically the software behind the dashboard, and it has an autonomous driving capability. The connected car is a major area of future investment for the company, alongside IoT.

For its customers, BlackBerry offers solutions driven by artificial intelligence (AI) and machine learning (ML) that are designed to protect applications, data, endpoints, devices and users against modern cyber attacks.