Cybercrime as a Service: A Scoping Review

Cloud computing has drastically altered the ways in which it is possible to deliver information technologies in a service-led structure; however, this has also been reflected in the cybercrime domain. Cybercrime as a Service is an economic model where a technically skilled actor offers a given cyberattack as an end-to-end service to non-technical actors who pay a subscription fee for said service. The services, which can vary in scope, targets, and delivery modes, include everything from vulnerability discoveries, delivery of the attack, and the attack itself to financial rewards to the subscriber. In this scoping literature review, we analysed 195 articles from both academic and grey literature with a view of investigating the services articles studied, the methodological approach and how the CaaS model is predicted to develop in the future. Our review indicates that further commercialisation of the model will further lower the barrier of entry to the cybercrime realm, increase the sophistication of the attacks and increase the resilience of the service providers and their ecosystem, which will result in harder shutdowns of services by the authorities. Furthermore, as the model becomes more accessible, groups such as organised crime groups and extremist actors may use it as well, which may have implications for criminal activity in both cyber and physical domains.