Ransomware authors have moved to the next stage, offering their creations on the model that the rest of the Web has adopted, researchers at Trend Micro say.
Recently, a new breed of ransomware called Stampado was being sold on the dark web, with a lifetime licence costing US$39.
The researchers said this was how ransomware-as-a-service worked: kits were sold in forums, making it very simple for non-technical people to mount their own operations.
Ransomware has been more effective than other forms of malware because of the encryption factor: people need their essential files to do their personal or business work.
{loadposition sam08}"What this means for a company depends entirely on what type of data they're trying to protect," Trend Micro said.
"A ransomware operator hardly understands what a certain file means to the victim, but by mass-encrypting entire folders, drives, and servers, a cybercriminal can demand any amount of money from hordes of victims and still get away with profit even if only a few favorably respond."
In response to a query as to why ransomware only seemed to affect Windows, Trend Micro senior architect Dr Jon Oliver told iTWire: "The majority of ransomware is currently affecting Windows – but this is changing. Linux servers are being attacked and ransomed. Basically any computer with value to you can be ransomed."
Asked about the spike in ransomware over the last two years or so, Dr Oliver said: " There has been a fundamental shift in the commodity malware underground. Sophisticated cybercriminals have found the ransomware business model profitable – and there has been a very large growth in ransomware."
He said there were a variety of business models being explored by cybercriminals when it came to ransomware-as-a-service. "They can rent you components and use your hardware or you can use their hardware. This is evolving."