Through leakware, the attacker, instead of destroying the data, threatens to release it on public domains. Also known as Doxware, leakware attacks are targeted at organizations like banks and nationalized entities that handle confidential or sensitive data.

RaaS is where the threat actors embrace a SaaS-like business model to carry out ransomware attacks. RaaS operates like an affiliate network and allows cybercriminals with low technical knowledge to subscribe to RaaS and launch ransomware attacks. Members of the affiliate earn a percentage of the ransom payment. The RaaS model is one of the prime reasons for the dramatic increase in ransomware attacks in the recent past because it removes the barrier of prerequisite coding knowledge to launch an attack.

Note that scareware, leakware, and RaaS are essentially crypto- or locker ransomware variants.

Bad Rabbit encrypts the user's file tables and demands Bitcoins to decrypt them. It primarily affected government authorities like the Ministry of Infrastructure of Ukraine. Some of the strings used in the code contained character names from the popular series Game of Thrones.

● Year of Emergence: 2017
● Target: Organizations and consumers
● Propagation: via fake Adobe Flash update request
● Areas Affected: Russia, Ukraine, and Eastern Europe
● Estimated extortion: Unknown, with a publicly admitted ransom payment of $1 million.

This malware directly infects the system's boot record and encrypts the NTFS file system. This prevents the system from booting into the OS until the ransom is paid. Some researchers have deemed it a nation state 'act of war' against Ukraine rather than cybercriminals' intent for money.

● Year of Emergence: 2016
● Target: Computers running on Microsoft Windows
● Propagation: via infectious email attachments
● Areas Affected: Mainly Ukraine
● Estimated extortion: Unknown

Cerber is crypto-ransomware RaaS that infects the system when the user clicks on a malicious ad or a spammy email initiated by the attacker.

● Year of Emergence: 2016
● Target: cloud-based Microsoft 365 users
● Propagation: phishing campaigns and malvertising
● Areas Affected: Across the globe
● Estimated extortion: Around $2 million in its first year

WannaCry launches a worm attack into the target system, locks the data, and demands a ransom in cryptocurrency. It spreads rapidly within systems. Its transport code uses an exploit known as EternalBlue–a cyberattack exploit developed by the U.S. National Security Agency (NSA)-- to gain access and make copies of itself.

● Year of Emergence: 2017
● Target: Computers running on Microsoft Windows
● Propagation: via a Microsoft exploit known as EternalBlue
● Areas Affected: 150 countries across the globe
● Estimated extortion: A total of 327 payments amounting to US$130,634.77

Dharma is a RaaS operation targeting small and medium businesses (SMBs) that cannot afford a high-profile cybersecurity team. It allows the attackers to encrypt the directory files on the victims' Windows-based systems. Once it conceals within the system, it infects each file being added to the directory. Threat actors using Dharma often demand relatively smaller ransom in the range of $8000 to $10000. However, the number of attacks that happened was of huge proportions, making it one of the most effective RaaS ever created.

● Year of Emergence: 2016
● Target: directories inside the user’s directory on Windows
● Propagation: via phishing emails or attacks on Remote Desktop Protocol (RDP) entry points.
● Areas Affected: Across the globe
● Estimated extortion: $24 million

Maze works on an affiliated network of cybercriminals and mainly targets SaaS companies. Once Maze affects an IT provider's network, it spreads onto the network of their clients' networks too. Maze usually encrypts data on the victim's system and threatens to leak it online unless the ransom is paid in cryptocurrencies.


● Year of Emergence: 2019
● Target: enterprise networks running on Windows
● Propagation: RDP brute force attacks and spam emails
● Areas Affected: Across the globe
● Estimated extortion: $24 million