Malware-as-a-Service (MaaS): Cybercrime’s Subscription Model
Malware-as-a-Service (MaaS) makes malware delivery available on demand to anyone with the funds to pay for it. Analogous to Software-as-a-Service (SaaS) models, MaaS is the next evolution of malware distribution. Hackers with the technical expertise to develop malware exploit kits can package their tools into a service for others to use.
This enables threat actors with little to no hacking knowledge to launch their own attacks.
To combat this, businesses must reconsider their security posture and develop new protections to keep their systems safe.
Impact of MaaS on the Cyber Threat Landscape
Malware-as-a-service lowers the skill level required to launch a malware campaign while also providing a significant revenue stream for hackers or groups with the technical abilities to develop MaaS products.
This has led to substantial changes in the cyber threat landscape.
Increasing Volume of Malware Attacks
Malware-as-a-Service (MaaS) increases the number of malware attacks.
Check Point’s 2025 State of Cyber Security Report found that global attacks against organizations increased by 44% in the last year. Unsurprisingly, making it easier and faster to launch malware attacks leads to greater volumes.
Some providers even offer direct malware for hire, allowing customers to:
- Simply choose the type of malware they want to use
- Select the number of devices they want to target
Attack Sophistication
Threat actors using Malware-as-a-Service (MaaS) tools are able to access attack vectors far more effectively than what they could develop independently. Combining this with a competitive cybercrime-as-a-service marketplace, where different groups strive to develop the most advanced products on the dark web,
MaaS has significantly increased the general sophistication of attacks.
- An example of this is the surge in cross-functional or multi-purpose malware, which combines elements of different malware types, making them harder to detect and remove.
Often used as the initial stage of an attack, this multi-purpose approach has become the most common type of malware attack. Data from the State of Cyber Security Report shows that 39% of organizations were affected by multi-purpose malware in 2024, representing a 25% increase compared to 2023.
Difficulty Tracing Malware Sources
MaaS not only increases the average sophistication of attacks, but it also makes it harder to trace attacks back to their source and stop future campaigns.
MaaS products disconnect the originator of the attack (who created the malware) from the threat actor carrying out the attack. Therefore, identifying the threat actor has little impact in preventing future attacks.
New customers simply purchase the MaaS tools and carry out similar attacks of their own.
Helping the Rise in Infostealer Attacks
MaaS has become a key enabling technology in the data exfiltration industry, and the business model is closely linked to the rise in infostealer attacks.
- The State of Cyber Security Report revealed a surge in infostealer attacks during 2024, increasing by 58%.
Infostealer attacks often provide the initial entry point for data breaches, gathering login credentials and other methods of accessing corporate networks. MaaS providers:
- Regularly supply the latest infostealer logs
- Or market their product alongside infostealers, enabling customers to target specific industries or organizations
MaaS customers or affiliates can browse infostealer logs on the dark web and purchase those that best match the goals of their malware campaigns.
Understanding Malware-as-a-Service
Malware distribution used to be direct from the hacker to their target.
Malware-as-a-Service (MaaS) adds a third party in the form of a customer that pays for exploit kits capable of launching attacks without having to write code or identify exploits.
Who Are MaaS Operators?
The cybercriminals offering malware-as-a-service products are referred to as MaaS operators, groups of hackers capable of developing their own malware variations. This requires significant technical expertise to:
- Test operating systems and applications
- Create new, effective methods of infiltrating networks and delivering malware
Beyond malware developers, these groups also require people such as managers and support personnel to help provide the product.
The Role of Affiliates
The service MaaS operators deliver is called an affiliate program, and the customers or clients purchasing it are also referred to as affiliates. While there are other motives, the most common reason for purchasing MaaS products is financial gain. Affiliates use malware to:
- Steal corporate data
- Disrupt services
This can include dedicated ransomware-as-a-service versions that encrypt sensitive business data, preventing its use until a fee is paid.
The SaaS-Like Model of Cybercrime
Part of the broader cybercrime-as-a-service business model, MaaS is inspired by the cloud-based software delivery method SaaS. Similar to SaaS, MaaS operators offer efficient and scalable cybercrime capabilities.
Affiliates also typically get a range of features, including:
- The ability to customize their attacks
- Control targets and volumes
- Receive support for their campaigns
6 Types of Malware Offered Through MaaS
MaaS operators offer a range of different malware types. The most common examples include:
- Information Stealers: Collecting data such as login credentials or personally identifiable information that is then sold for future attacks.
- Ransomware-as-a-Service: A form of MaaS that encrypts or exfiltrates an organization’s data, demanding a ransom for its return.
- Loaders: The initial entry that downloads other payloads onto a victim’s system.
- Backdoors: Allows the attacker to take control of the victim’s system remotely.
- Cryptojacking: Malware that targets systems to use their compute power to mine cryptocurrency.
- Botnets: Some operators provide access to botnets, networks of malware-infected devices that can be used for Distributed Denial of Service (DDoS) attacks.
There are many other types of malware provided by operators, including spyware, keyloggers, and trojan horse viruses.
The Business Model Behind MaaS
The MaaS business model is based on hacker groups increasing their returns and impact by selling malware exploit kits to third parties, rather than focusing on making money directly by launching their own attacks.
The MaaS affiliate programs these groups develop are marketed and distributed on:
- The dark web
- Underground forums
- Encrypted messaging platforms like Telegram
Customers identify MaaS operators based on advertised capabilities and reputation. The payments they make are typically done via cryptocurrency to conceal their actions.
Payment Models
There are several payment models in the malware economy, including:
- One-off payments for a campaign
- Subscription pricing based on monthly or annual installments
- Profit-sharing payments, where the MaaS operator and affiliate split the returns from utilizing the service (e.g., ransoms received when using a ransomware-as-a-service tool)
- Payments based on the number of malware-infected devices
Strategies to Defend Against MaaS Threats
Malware-as-a-service threats based on the same affiliate program are not identical.
MaaS operators typically provide customizable malware and variations that limit the effectiveness of signature-based detection. Therefore, you should use more advanced techniques that utilize behavior-based detection to identify and contain MaaS threats.
Other important strategies and controls to defend against MaaS threats include:
-
- Comprehensive endpoint protection that monitors every device and detects potential malware.
- Implementing next-generation firewalls and intrusion detection technologies.
- Network segmentation to limit the impact of breached systems.
- Updating every system and software used on your network to get the latest protections.
- Zero Trust Network Access (ZTNA) that makes users and devices continually authenticate themselves regardless of location.
- Security awareness training to ensure employees can identify suspicious communications.
- Incident response planning and backup recovery strategies that limit the impact of malware attacks and help you return to normal operations as quickly as possible.
Malware Protection with Check Point
Every organization serious about cybersecurity should consider how malware-as-a-service attacks affect its security posture. With a greater number of more sophisticated malware attacks now occurring, you need a robust and thorough strategy to deal with these threats.
Harmony Endpoint from Check Point delivers a comprehensive security solution capable of identifying and minimizing the impact of MaaS attacks.
Learn about Harmony Endpoint by requesting a demo or read more about Check Point’s malware protection capabilities here.
