Malware-as-a-Service (MaaS) Economy Guide: How Rented Malware Shapes Your Defences

Most malware that reaches an organisation today was rented, not written, by the people who deploy it. Malware-as-a-service (MaaS) splits cybercrime into suppliers and customers: developers sell stealers, loaders and remote access tools by subscription, other providers sell obfuscation, hosting and traffic, and buyers run campaigns without writing code. This guide explains how that economy is organised, what the products cost according to official and research sources, how access flows from a stealer or loader infection to a ransomware operator, and what the model means for threat modelling, detection and response. It is written for threat intelligence analysts, SOC leads and security managers who need to turn "cybercrime ecosystem" into concrete defensive priorities. The Cybercrime Ecosystem Guide gives the wider overview; this page goes deeper on rented malware.

Key takeaways

• Prices are low and published. Microsoft reported Lumma Stealer tiers from 250 to 1,000 US dollars, with source code at 20,000 US dollars, and Trellix reported DarkGate subscriptions of up to 15,000 US dollars per month.
• One family serves hundreds of customers. Lumma's developer claimed about 400 active clients in 2023, and over 394,000 Windows computers were infected in two months of 2025 (Microsoft), so the same behaviours recur across many unrelated campaigns.
• Access is the product. DOJ alleges QakBot's leader sold access to ransomware co-conspirators for a share of ransoms, and ATT&CK describes SocGholish's operator as an initial access broker. Stealer and loader infections are early ransomware warnings.
• Takedowns shift volume rather than end it. Operation Endgame has run repeated phases since May 2024 against droppers, stealers and their successors, which shows both the pressure and the resilience of the market.
• Defend the shared stages. Rented families differ in code but share delivery, execution and credential theft patterns, so behaviour-based controls and fast session revocation pay off across the whole market.

How the MaaS economy is organised

A MaaS operation looks like a small software company with a criminal customer base. The developer maintains the code and infrastructure; affiliates or customers buy access to a builder and a control panel; specialist providers supply the pieces that make campaigns work.

ATT&CK models the buyer's side of this as resource development: T1588.001 Obtain Capabilities: Malware, T1588.002 Tool, T1650 Acquire Access, T1583.001 Domains and T1608.001 Upload Malware. These are hard to observe directly, which is why threat intelligence on the suppliers matters.

Product lines: stealers, loaders and RATs

Three product types make up most rented malware. They often appear in the same intrusion, one delivering the next.

Families blur these lines: DarkGate combines loader, stealer and RAT functions, and StealC has dropper functions according to Operation Endgame. Profiles: Lumma Stealer Guide, QakBot Malware Guide, DarkGate Malware Guide, SocGholish and Fake Browser Update Malware Guide.

Pricing and business models

Two practical consequences follow. First, entry cost is lower than most security tool licences, so the pool of attackers is large and includes low-skill buyers. Second, the developer's incentive is customer retention, so families ship regular updates to defeat published detections: Trellix recorded DarkGate releasing an update after researchers published analysis and decryption tools for version 4.

Supporting services: obfuscation, traffic and infrastructure

• Crypters and packers: services that re-wrap a payload so signatures and hashes no longer match. ATT&CK covers the result as T1027.002 Software Packing and T1027.013 Encrypted/Encoded File. The defensive lesson is that hash-based blocking ages within hours; behaviour and reputation controls last longer.
• Counter-antivirus testing: services that let criminals check whether security products detect their files before a campaign. The May 2025 Endgame-listed action against a "key service for malware developers" shows law enforcement treats these as core infrastructure.
• Traffic and distribution: malvertising, search poisoning and traffic distribution systems route victims to payloads. Microsoft lists malvertising with cloned vendor sites, compromised websites, trojanised cracked software, GitHub-hosted payloads and ClickFix fake CAPTCHA pages for Lumma, and notes one campaign used the Prometheus traffic distribution system. Groups that recruit and pay people to drive traffic to stealer downloads, often called traffer teams, sit in this layer. See the ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide.
• Hosting and domains: tiered C2 servers, rapidly rotating domains and abused legitimate services. Lumma's backbone ran on about 2,300 domains actioned in 2025, and the SocGholish action in 2026 covered 326 servers and 142 domains (Operation Endgame).
• Markets for stolen data: stealer logs and access are traded on forums and messaging channels. Europol's IOCTA 2025 is titled "Steal, deal and repeat", reflecting stolen data as both target and enabler. See the Initial Access Brokers Guide and Dark Web Monitoring Guide.

What the model changes for defenders

• Threat model by function, not by actor: you are more likely to face "a stealer customer" than a named group. Plan controls for each product type in the table above.
• Treat commodity alerts as serious: a stealer or loader on a corporate device may be resold within days to a ransomware operator. Microsoft observed ransomware actors including Octo Tempest using Lumma.
• Identity is the payload: stealer logs contain cookies and tokens that bypass sign-in MFA. Response must revoke sessions and refresh tokens, not only reset passwords. See the Infostealer Logs Monitoring and Response Guide.
• Non-human credentials leak too: developers' machines hold API keys, cloud access keys, CI tokens and SSH keys. A stealer on a developer laptop is a non-human identity incident. Rotate those secrets as part of response; the Secrets Management Guide covers the controls.
• Use the market's weak points: the economy depends on users running files, on unmanaged browsers storing passwords, and on long-lived sessions. Each is a control you own.

Small versus large organisations

How access flows from a rented infection to ransomware

The sources describe a repeatable chain. Knowing where you are in it tells responders how urgent an alert is.

1. Delivery: a customer of a loader or stealer runs a campaign through email, malvertising, a compromised website or a collaboration platform. Proofpoint describes SocGholish filtering visitors so that only eligible Windows users receive the payload.
2. Profiling: the first-stage malware reports host, user and domain details. Red Canary notes most SocGholish infections stop here, which is why many alerts look harmless.
3. Sorting and sale: domain-joined corporate hosts are worth more. Proofpoint reports ransomware such as WastedLocker, Hive and LockBit following SocGholish on domain-joined victims, and RATs on others.
4. Hand-off: a second payload, often a different family from a different customer, gives the buyer interactive access. Microsoft observed QakBot leading to Cobalt Strike, ScreenConnect and NetSupport Manager in Storm-1811 intrusions.
5. Monetisation: data theft, extortion or ransomware. DOJ ties QakBot access to at least eight ransomware strains.

Defensive reading: the time between steps 2 and 4 is your window. Fast isolation and credential and session revocation at step 2 removes the asset the broker is trying to sell.

Putting MaaS intelligence to work

1. Inventory: list the MaaS families seen in your own telemetry and in your sector's advisories over the last 12 months, grouped by product type.
2. Map: for each family, record its delivery routes and ATT&CK techniques from the ATT&CK software page, and mark which shared stages your detections cover.
3. Pilot controls: deploy script and executable restrictions in audit mode for a pilot ring of 5 to 10 percent of devices for two weeks, review blocked events, then enforce. Roll back by returning the policy to audit mode, not by deleting it.
4. Automate response: connect stealer detections to identity tooling so sessions are revoked automatically, with an analyst confirming afterwards.
5. Review after takedowns: when law enforcement disrupts a family, check notification channels, scan for leftover payloads and watch for the successor family that customers move to.

Detection and measurement

Map detections to the stages that rented families share. A rule that catches a browser spawning a script host catches SocGholish, ClickFix-delivered stealers and many loaders at once.

Metrics that show the programme is working:

• Median time from stealer or loader detection to session and token revocation (target: under one hour).
• Percentage of managed devices where browsers cannot store passwords outside an approved manager.
• Percentage of endpoints where standard users cannot run script hosts or unsigned executables from user folders.
• Number of stealer log exposures of corporate credentials found by monitoring per quarter, and the percentage remediated within 24 hours.
• Detection coverage across the five shared stages, tested with emulation at least twice a year.

Framework mapping

Common failure patterns

• Closing commodity alerts as "low": a quarantined stealer still ran long enough to upload a log. Assume exposure and revoke sessions.
• Resetting passwords but not sessions: stolen cookies keep working after a password change unless sessions and refresh tokens are revoked.
• Relying on hash blocklists: crypters change hashes per build; indicator feeds help with scoping, not prevention.
• Forgetting personal devices and browsers: stealers on unmanaged home machines with synced corporate browser profiles leak work credentials outside your telemetry.
• Ignoring developer secrets: API keys and cloud credentials on infected developer machines are rarely rotated, and are valuable to buyers.
• Blaming the user and moving on: paste-and-run and fake update lures are designed to beat awareness training. Pair training with technical controls that stop the Run dialog, script hosts and unsigned executables doing harm when a user is fooled.
• Celebrating a takedown as an end state: Operation Endgame's own phases target successor groups that re-emerged after earlier takedowns.

Practitioner checklist

• Classify current threats by MaaS product type (stealer, loader, RAT) and assign controls to each.
• Write a stealer response runbook that revokes sessions and refresh tokens, resets passwords and rotates developer and service secrets.
• Block or restrict script hosts and unsigned executables from user-writable folders after an audit-mode pilot.
• Disable unmanaged browser password storage on corporate devices and restrict profile sync to managed accounts.
• Subscribe to stealer log and credential exposure monitoring for your domains.
• Track law enforcement actions such as Operation Endgame and check victim notification channels after each phase.
• Measure time from detection to token revocation and report it monthly.
• Review detection coverage against the five shared stages twice a year with emulation.

Standards and references

• Microsoft On the Issues: Disrupting Lumma Stealer, Microsoft leads global action against favored cybercrime tool
• Microsoft Threat Intelligence: Lumma Stealer, breaking down the delivery techniques and capabilities of a prolific infostealer
• Operation Endgame: News
• Europol: Internet Organised Crime Threat Assessment (IOCTA) 2025
• US Department of Justice: Leader of Qakbot Malware Conspiracy Indicted
• Trellix: The Continued Evolution of the DarkGate Malware-as-a-Service
• MITRE ATT&CK: Obtain Capabilities: Malware (T1588.001)
• MITRE ATT&CK: Acquire Access (T1650)

Related NHI Mgmt Group resources: Cybercrime Ecosystem Guide · Ransomware-as-a-Service Business Model Guide · Infostealer Threat Guide · Cybercrime Law Enforcement Takedowns Guide