Cybercriminals Contemplate 'Exploit-as-a-Service' Model

Researchers share their findings on the current zero-day market and how criminals' strategies may shift in the future.

Dark Reading Staff, Dark Reading

November 17, 2021

1 Min Read
Dark Reading logo in a gray background | Dark Reading

Cybercriminals' strategies may expand to include an "exploit-as-a-service" business model, report researchers investigating how attackers continue to exploit organizations' weaknesses.

The Digital Shadows Photon Research Team collected evidence from cybercriminal markets and forums to better understand how vulnerabilities are bought and sold. They report some high-profile criminal groups, such as ransomware gangs, have amassed enough funds to compete with traditional buyers of zero-days — an expensive and competitive market, researchers note.

Their investigation revealed criminals discussing ideas for an exploit-as-a-service model that would "inevitably lower the barrier" for accessing these sophisticated exploits, the team wrote in a blog post.

"This model would allow capable threat actors to 'lease' zero-day exploits to other cybercriminals to conduct their attacks," the report states. The benefit goes both ways: A developer can earn high profits when selling a zero-day exploit; however, it takes a lot of time to finalize a sale. This model would let developers generate even more earnings by renting out their exploits while waiting on a buyer.

"Additionally, renting parties could test the proposed zero-day and later decide whether to purchase the exploit on an exclusive or non-exclusive basis," researchers noted.

Read more details here.

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights