{"id":20699,"date":"2017-01-19T11:38:11","date_gmt":"2017-01-19T18:38:11","guid":{"rendered":"https://www.webroot.com/blog/?p=20699"},"modified":"2018-01-30T12:37:28","modified_gmt":"2018-01-30T19:37:28","slug":"satan-new-ransomware-service","status":"publish","type":"post","link":"https://www.webroot.com/blog/2017\/01\/19\/satan-new-ransomware-service\/","title":{"rendered":"Satan: A new ransomware-as-a-service"},"content":{"rendered":"<p>Ransomware as a Service (RaaS) has been growing steadily since it made its debut in 2015 with Tox. With the new Satan service, it\u2019s easier than ever. The idea is to use this web portal to contract threat actors to create new ransomware samples for distribution via the desired attack vector. This allows any potential cybercriminal, regardless of their skill or coding knowledge, to upgrade to an encrypting ransomware business model.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-20701\" src=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-1.png\" alt=\"Satan - Image 1\" width=\"1002\" height=\"449\" srcset=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-1.png 1002w, https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-1-768x344.png 768w\" sizes=\"(max-width: 1002px) 100vw, 1002px\" \/><\/p>\n<p>Those who join the program have a number of viewing options in the portal. The Account panel shows various stats, including how much money has been made, infection count, current share percentage, etc.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-20703\" src=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-2.png\" alt=\"Satan - Image 2\" width=\"1006\" height=\"1119\" srcset=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-2.png 1006w, https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-2-768x854.png 768w\" sizes=\"(max-width: 1006px) 100vw, 1006px\" \/><\/p>\n<p>All a criminal needs to do is enter a few simple pieces of information to generate brand new malware that\u2019s ready to infect victims. Note that the portal author specifically requests downloaded samples not be shared with VirusTotal, decreasing the likelihood that security vendors will have encountered the variant.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-20705\" src=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-3.png\" alt=\"\" width=\"1006\" height=\"1119\" srcset=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-3.png 1006w, https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-3-768x854.png 768w\" sizes=\"(max-width: 1006px) 100vw, 1006px\" \/><\/p>\n<p>Since the darknet web portal creator takes a 30% cut of all ransoms, it\u2019s in his best interests to make sure as many victims are infected as possible. He provides a guide with step-by-steps instructions on how to deploy malware using obfuscation techniques to avoid detection.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-20707\" src=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-4.png\" alt=\"\" width=\"1006\" height=\"1119\" srcset=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-4.png 1006w, https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-4-768x854.png 768w\" sizes=\"(max-width: 1006px) 100vw, 1006px\" \/><\/p>\n<p>The author also advertises his web portal on underground forums, and explains the payload and the payout scheme. After all, affiliates\u2019 success means he gets a bigger cut.<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-20709\" src=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-5.png.jpg\" alt=\"\" width=\"904\" height=\"593\" srcset=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-5.png.jpg 904w, https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2017\/01\/Satan-Image-5.png-768x503.jpg 768w\" sizes=\"(max-width: 904px) 100vw, 904px\" \/>Although Webroot will catch this specific variant of ransomware as a service in real time before any encryption takes place, don\u2019t forget that the best protection in your anti-ransomware arsenal is a good backup solution. You can use a cloud service or offline external storage, but keeping it up to date is crucial for business continuity.<\/p>\n<p>For best practices for securing your environment against encrypting ransomware, see our <a href=\"http:\/\/wbrt.io\/hcc8\">community post<\/a>.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ransomware as a Service (RaaS) has been growing steadily since it made its debut in 2015 with Tox. With the new Satan service, it\u2019s easier than ever. The idea is to use this web portal to contract threat actors to create new ransomware samples for distribution via the desired attack vector. This allows any potential [&hellip;]<\/p>\n","protected":false},"author":21,"featured_media":20723,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[3929,15237,3943,20247,5443,5435,3477,20245,3937,20241,3891,3947,3471,5439,3989,4313,20243,3525],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/20699"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=20699"}],"version-history":[{"count":9,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/20699\/revisions"}],"predecessor-version":[{"id":20735,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/20699\/revisions\/20735"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/20723"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=20699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=20699"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=20699"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=20699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}