Cybercrime-as-a-service explained: what is sold, and what it means for defenders

Key takeaways

• CaaS sells capability in addition to tools: access, malware, phishing kits and DDoS, often with customer support.
• It lowers the skill barrier, so more attackers can run competent attacks.
• Specific tool names and prices on criminal markets change constantly and are not verified here.
• Initial access brokers are a key part of the ransomware supply chain.
• Fundamentals defeat most CaaS offerings: patching, MFA, backups, monitoring and user training.

What is cybercrime-as-a-service?

It is the same idea as any other "as-a-service" business, applied to crime. Instead of building their own tools, attackers buy or rent capability from others who specialise in it. Common categories include:

• Initial Access Brokers (IABs): sell already-compromised access to a company's network, often through stolen credentials or exploited vulnerabilities.
• Ransomware-as-a-Service (RaaS): operators provide the ransomware and infrastructure, and affiliates run the actual attacks for a cut of the proceeds.
• Phishing-as-a-Service: ready-made phishing kits and hosting for cloned login pages.
• DDoS-for-hire (booter/stresser services): paid denial-of-service attacks against a target.
• Malware-as-a-Service: rented or sold malware, sometimes with "support" included.

This article does not name or link specific current offerings, since naming active criminal services would not help readers and such listings change constantly.

Why does this matter for defenders?

Because it changes the threat model. You no longer need to assume your attacker is highly skilled. A buyer with money and little technical ability can rent a capable attack chain. That means:

• Low-sophistication indicators (a known phishing kit, a common RaaS payload) can still cause a full breach.
• Initial access brokers mean one earlier, smaller compromise (a stolen password, an unpatched VPN) can be resold and lead to a much bigger attack later.
• Attribution is harder, because the buyer and the toolmaker are different people.

How does the supply chain typically work?

1. An access broker compromises or buys access to a network, often through phishing or an unpatched internet-facing system.
2. They advertise that access for sale on a forum or marketplace.
3. A ransomware affiliate buys it and deploys ransomware using tooling provided by the RaaS operator.
4. Proceeds are split between the affiliate and the operator, and sometimes the original access broker.

This shows why stopping the earliest step, the initial compromise, matters so much.

What defences matter most against CaaS?

• Patch internet-facing systems quickly. These are the common entry points access brokers look for.
• Phishing-resistant MFA on remote access, email and admin accounts.
• Email filtering and user training against phishing kits, which are often generic and detectable.
• Network segmentation so one compromised account does not reach everything.
• Offline, tested backups against ransomware.
• DDoS protection for internet-facing services, if availability is critical.
• Monitoring and logging so access broker activity is caught before it is resold.

What should security professionals study?

Frameworks such as MITRE ATT&CK describe the techniques used across this chain, independent of which specific criminal service was involved. Understanding the pattern (access, tooling, monetisation) matters more than memorising brand names of criminal products, which change constantly.

Where does this fit in a career?

Threat intelligence analysts track these trends to inform defence priorities. See our CTIA course and SOC course.

Next steps

For structured learning on these threats, see our CTIA course. Related reading: dark web AI risks.