Cybercrime-as-a-Service: Market Size and Growth

• $10.5 Trillion Annual Cost: Cybersecurity Ventures projected global cybercrime damages of about $10.5 trillion in 2025, after years of roughly 15% annual growth. It now expects growth to slow to about 2.5% a year, plateauing around $12.2 trillion by 2031, which would still make cybercrime one of the largest shadow economies in the world.
• Ransomware Exploitation: Ransomware appears in 48% of breaches in the Verizon 2026 DBIR, up from 44% a year earlier. Success rates keep falling: Coveware recorded a record-low 23% payment rate in Q3 2025 and about 20% in Q4 2025, and in Q3 2026 nearly 80% of incidents it handled were resolved without a ransom payment.
• Exploit as a Service: Cyjax found that companies listed for sale by Initial Access Brokers (IABs) in 2024 had combined revenues of slightly over $3 trillion, and that the listings had a minimum combined asking value of about $6.3 million. Rapid7's 2025 IAB research put the average access price at just over $2,700, with 71.4% of listings offering privileged access.
• Phishing & BEC: Phishing remains a top attack vector: IBM found it was the most common initial vector in 2025, at 16% of breaches, with an average breach cost of about $4.8M. The FBI IC3 logged 191,561 phishing/spoofing complaints and $3.05B in BEC losses in 2025, and Verizon's 2026 DBIR found credential abuse in 39% of breaches at some stage.
• AI/Automation: IBM found 16% of 2025 breaches involved attackers using AI, most often for phishing and deepfake impersonation, and its 2026 report found 1 in 4 malicious breaches were AI-enabled, costing about $6M on average. The FBI IC3 received 22,364 AI-related complaints with $893M in losses in 2025. AI driven attacks e.g. the deepfake CFO fraud at Arup that cost about $25M are surging. Microsoft's 2024 Digital Defense Report said its customers face more than 600 million attacks per day. On the defense side, extensive AI and automation saved about $1.9M per breach and shortened the breach lifecycle by 80 days (IBM 2025); IBM's 2026 report puts the savings at $1.93M.
• Cost per Breach: IBM reports the global average breach cost hit a record $4.99M in 2026, up from $4.44M in 2025. In the U.S. it is $11.5M, the highest of any country and more than double the global average. By industry, IBM's 2026 figures put healthcare at about $6.64M and financial services at about $6.3M.
• Regional Trends: North America remains the top target: the FBI IC3 recorded 1,008,597 complaints and $20.9B in reported losses in 2025, up from $16.6B in 2024. Europe's GDPR and NIS2 regimes make data extortion potent. In the Middle East, IBM found average breach costs fell about 18% to SAR 27M in 2025. APAC is a fast-growing crypto market, fueling CaaS volume, while Latin America is an emerging ransomware front as attackers seek regions with weaker defenses.
• Encryption, Crypto & Dark Web: Cryptocurrencies power CaaS: Chainalysis estimates illicit addresses received at least $154B in 2025, up 162% and driven largely by sanctioned entities, though still below 1% of on-chain volume. Stablecoins accounted for 84% of illicit transaction volume. Mixers and chain hopping keep criminal crypto in circulation. The dark web economy prices stolen personal data cheaply but sells high value domain admin access for far more.
• DDoS as a Service: Attack volume exploded: Cloudflare mitigated 47.1M DDoS attacks in 2025, up 121% from 2024, including 20.5M in Q1 2025 alone (a 358% YoY increase). The Aisuru botnet, estimated at 1-4M infected hosts, launched a record 29.7 Tbps attack in Q3 2025, and Cloudflare blocked a new record of 31.4 Tbps in Q4 2025. DDoS extortion is rising too: 12% of Cloudflare customers targeted by DDoS in Q4 2024 reported ransom threats.
• Rising 'Double/Triple' Extortion: Coveware observed data exfiltration in 76% of its Q3 2025 cases and 71% in Q3 2026. When victims have secure backups, criminals pivot to double or triple extortion, threatening to leak stolen data or launch collateral attacks on customers/partners if ransom isn't paid. IBM found the average extortion or ransomware incident cost $5.08M in 2025 when disclosed by the attacker.

Cybercrime as a Service CaaS refers to the industrial scale criminal economy where malicious tools and access are sold or rented like subscriptions. Instead of lone hackers, today's landscape features professional syndicates offering RaaS Ransomware as a Service, PhaaS Phishing as a Service, IABs, DDoS booters, malware subscriptions, and even AI driven fraud tools. This report quantifies the size, trends, and economics of CaaS using the latest 2025 and 2026 data. Cybercrime has become a systemic drag on the global economy: Cybersecurity Ventures estimated it would cost around $10.5 trillion in 2025, which would make it the world's third-largest economy after the U.S. and China if it were a country. Such staggering figures underscore why detailed statistics matter: to understand where attackers succeed phishing and RaaS, where defenses still fail, and how the as a service model is democratizing high end attacks. Notable headlines include the record $1.5B crypto hack of Bybit Lazarus Group, 2025 and a record $75M ransomware payout by a Fortune 50 company in 2024. These numbers highlight what efficient underground markets can do: turn cheap tool subscriptions into large fraud schemes, or let novices run attacks that once required elite skills. Dedicated fraud marketplaces like STYX Market package stolen financial data, OTP bots, and cash-out services the same subscription way.

What Are Cybercrime as a Service Statistics?

Within broader cybersecurity statistics, CaaS statistics function as market and operational metrics for the underground economy of cybercrime. Instead of legal sales figures, we measure incidents, payments, losses, prices of illicit services, and detection times.

For example, the number of ransomware attacks per day, the median ransom amount, and the percentage of victims who pay are key CaaS stats. These stats help illustrate how lucrative the business model is: defenders must stop every attempted breach, a continuous 24/7 challenge, while attackers only need one success. A useful analogy: CaaS is to cybercrime what SaaS is to legitimate software. It breaks down complex malware and attacks into plug-and-play services, democratizing access for criminals. For instance, phishing kits and AI deepfake tools are now rented on subscription, turning high skill tasks into cheap commodities.

Global Overview

This overview highlights an economy that keeps growing even as some per-victim metrics fall. Ransomware's share of breaches rose again in Verizon's data even as fewer victims pay, and DDoS volume more than doubled in 2025. Defensive spending keeps rising, but it still lags the scale of the criminal market.

Cost Breakdown

Cybercrime imposes costs at multiple levels. The global average cost of a data breach reached a record $4.99 million in IBM's 2026 report, up from $4.44 million in 2025, but this masks huge variability. IBM found U.S. breaches average $11.5M, far above most other countries. Multi country/regulatory fines inflate costs; for example, Europe's GDPR exposure makes data leaks double extortion especially expensive. The cost of cybercrime includes ransom payments, recovery and remediation expenses, lost business/downtime, and reputational/legal fallout. Notably:

Faster detection has shortened breaches: IBM's 2025 report put the mean time to identify and contain a breach at 241 days, a nine-year low, but recovery costs remain steep. Sophos reported that 97% of organizations whose data was encrypted recovered it in 2025, yet only 54% relied on backups. In its 2026 survey backup-based recovery rose to 66%, while 48% of victims with encrypted data paid the ransom. The lesson: Investing in backups and detection pays off. Industry differences are stark: IBM found healthcare breaches averaged $7.42M in 2025 and about $6.64M in 2026, while financial services averaged about $6.3M in 2026.

Cost Drivers and Trends

• AI & Automation: Organizations using AI and automation extensively in security saw about $1.9M lower breach costs and breach lifecycles 80 days shorter (IBM 2025); IBM's 2026 report puts the savings at $1.93M. Conversely, lack of AI preparedness governance, monitoring is a growing vulnerability. Notably, 63% of ransomware victims in 2025 report they refused to pay, up from 59% in 2024, demonstrating improved backups and regulations deter payments.
• Double/Triple Extortion: Pre breach preparation e.g. IR, backups means encryption only attacks are less effective: only 50% of attacks in Sophos's 2025 survey encrypted data, the lowest in six years, though that rose to 56% in 2026. Attackers have shifted to exfiltrate first: Coveware found data theft in 76% of Q3 2025 ransomware cases and 71% in Q3 2026. This evolution has kept extortion profitable, even though the payment rate for exfiltration only attacks fell to 19% in Q3 2025 and a record-low 15% in Q2 2026, because the potential costs of data breach fines and brand damage remain high.
• Legal/Regulatory: Global cost includes fines and legal fees. For example, US firms face SEC cyber disclosure rules; Europe's NIS2/GDPR impose multi million penalties. Insurers now demand MFA, zero trust and offline backups. Meanwhile, IBM's 2025 report found only 40% of ransomware victims involved law enforcement, down from 2024, pushing more firms to rely on their own prevention and recovery.

Attack Vector Distribution

According to recent studies, attacks now blend traditional techniques with advanced tools. The table below shows major initial vectors based on IBM's 2025 breach data and Verizon's DBIR, and their impact:

Sources: IBM Cost of a Data Breach Report 2025, Verizon DBIR 2025 and Verizon DBIR 2026.

Industry Breakdown

Certain sectors bear disproportionate risk in CaaS:

• Healthcare: Among the most targeted and costly. In IBM's 2025 report healthcare was the costliest industry for the 14th straight year at $7.42M, and IBM's 2026 report puts healthcare breach costs at about $6.64M, reflecting expensive patient data recovery and life safety stakes. Attackers know hospitals are under political pressure to pay ambulances diverted, surgeries canceled.
• Financial Services: Always a top target due to direct access to money. Costs averaged $5.56M in IBM's 2025 report and about $6.3M in 2026; banks invest heavily in detection. High profile cases include waves of banking trojans and real time payment fraud in LATAM and SEA.
• Technology/Manufacturing: Typically mid range: IBM's 2025 report put industrial breaches at $5.00M and technology at $4.79M. Tech firms see many credential stealing/phishing attacks; manufacturing suffers from supply chain and IP theft. The US industrial sector saw notable ransomware disruptions in 2024-25.
• Retail & Public/Government: Lower average costs per incident but high frequency of small breaches, point of sale skimming, identity theft. However, regulatory factors e.g. GDPR fines mean retail and government can still face large penalties for data leaks.

The IoT and Services sectors are increasingly targeted by DDoS as service and botnets. APAC’s financial and crypto industries are also lucrative, as grassroots crypto adoption creates new fraud vectors.

Regional Breakdown

• North America USA/Canada: The top target region. FBI IC3 reported 859,532 complaints in 2024 with $16.6B in losses, rising to 1,008,597 complaints and $20.9B in 2025. The US's high breach costs, $11.5M avg in 2026, reflect greater digital asset value and regulations. US defense spending is highest globally. Cyber insurers and regulators SEC rules, CISA guidelines are leading to higher standards.
• Europe & MENA: Europe faces high regulatory exposure under GDPR and NIS2. Average breach costs in most European countries remain well below US levels. IBM found Middle East breaches averaging SAR 27M, about $7.2M, in 2025, an 18% decline thanks to rapid security investment. The region also sees a surge of sophisticated hacktivism e.g. conflict related attacks targeting energy and supply chains. Security budgets in EMEA are rising, but legacy systems remain a risk.
• Asia Pacific: A fast growing cybercrime market. Rapid digitization in India, Indonesia, Vietnam expands the attack surface. APAC leads in crypto usage, making it a hotbed for crypto fraud and money laundering: Chainalysis reports APAC monthly on-chain value roughly tripled over 30 months. Notably, DDoS attacks often originate from Asia e.g. botnets in Indonesia. APAC nations are heavily targeted by both state sponsored campaigns and financially motivated CaaS actors.
• Latin America: Emerging front. Ransomware groups increasingly target the region as attackers shift to regions with fewer defenses. Brazil is a hotspot for banking malware and fraud. Cybercrime groups here are professionalizing e.g. RagnarLocker style RaaS strains first seen. Data breach costs are growing, but still below US/EU levels. Cybersecurity awareness is improving, and insurance is less prevalent.

Major CaaS Incidents of 2024-2025

While many CaaS incidents go unreported, notable 2024-2025 examples illustrate the scale:

• Lazarus/Bybit Hack Early 2025: North Korea's state sponsored Lazarus Group stole $1.5 billion in cryptocurrency from the Bybit exchange, setting a new record for a single crypto heist. Chainalysis counted more than $2.17B stolen from crypto services in the first half of 2025 alone. This demonstrates how national hacker groups leverage CaaS style tooling and laundering networks to execute massive thefts.
• Dark Angels Record Ransom 2024: Zscaler ThreatLabz reported that a Fortune 50 company paid a $75 million ransom to the Dark Angels group, nearly double the highest previously known payment. The victim was not named. This single payout underscores Big Game Hunting extortion.
• Arup Deepfake Fraud Early 2024: An employee in Arup's Hong Kong office joined a video call with deepfakes of the CFO and colleagues and made transfers totaling HK$200M, about $25 million. No malware was used; the attacker simply exploited trust via generative AI. This case highlights the new social engineering frontier of CaaS.

Emerging Trends

• AI Arms Race: Generative AI fuels both offense and defense. Criminals use AI to create hyper realistic spear phish emails and deepfakes on demand. Notably, 82.6% of phishing emails analyzed by KnowBe4 between September 2024 and February 2025 showed some use of AI. Defenders are racing to deploy AI based threat hunting: automated anomaly detection, natural language log analysis, and LLMs for IoC triage. Expect hybrid teams where AI augments human analysts saving the ~$1.9M IBM found in 2025. Attackers are already experimenting with AI driven polymorphic malware.
• Volume vs. Value: The paradox continues: attackers send much more volume but fewer victims pay. As Coveware notes, ransomware payment rates fell to historic lows, 23% in Q3 2025 and about 20% in Q4 2025, while the median payment swung from $140,000 in Q3 2025 to $400,000 in Q3 2026 as some whales still pay millions. This bifurcates the market: automated low level RaaS kits vs. elite syndicates targeting enterprises. In response, we see more batch phishing and scanning a relentless flood of probes, while true hand crafted attacks focus on critical infrastructure and wealthy targets.
• Shadow AI & MFA Bypass: The rapid rollout of MFA has criminals developing man in the middle phishing kits that intercept one time codes. For example, the BlackForce and Tycoon kits as noted by Microsoft and The Hacker News allow real time stealing of credentials and MFA tokens. Attackers even sell session cookies enabling silent full account takeover. This cat and mouse will drive defenders toward stronger authentication biometrics, FIDO2 and user behavior analytics.
• Supply Chain & IAB Blurring: The traditional malware supply chain has further fragmented. IABs now routinely target Managed Service Providers and third parties: compromise an MSP, and access dozens of downstream clients. Breaches of SolarWinds, Log4j, and MOVEit have fed the IAB market. Expect more one to many campaigns as supply chain risk remains critical.
• Weaponization of Discord/Tor: CaaS actors increasingly communicate via encrypted chat apps and Tor. New pay for chat support lines Telegram helpdesks and reputation based trust smart escrow are standard. Exit scams still happen on dark markets, but big actors use decentralized networks e.g. Hydra/Abacus style. One trend: crypto hosting services providing bundled laundering + escrow, essentially Money Laundering as a Service.
• Geopolitical Pressures: Sanctions evasion via crypto is a major undercurrent. Chainalysis found sanctioned entities received about $104 billion in 2025, the majority of illicit volume, with the ruble-backed A7A5 stablecoin alone processing $93.3B in about ten months. We also see nation states indirectly fueling CaaS hacktivist cartels in Eastern Europe both sell services and target Western firms to sow chaos. Ukraine conflict cyber tactics e.g. wiper malware often spill over to criminal markets as DDoS for hire proxies or ransomware DIY.

What These Statistics Mean

The numbers paint a clear strategic picture: Cybercrime has industrialized. Attacks are no longer random blips but a constant, predictable tax on digital business. Organizations must view CaaS not as improbable risk but as a business reality. The low ransom pay rate, about 20% in late 2025, is good news for defenders: paying ransoms is no longer an effective business continuity strategy. Instead, investments must focus on prevention hardening, patching, least privilege and rapid recovery backups, IR playbooks.

The ROI math overwhelmingly favors attackers: tiny costs e.g. a rented phishing kit versus outsized returns; a few successful ransoms cover hundreds of those kit costs. Thus, even if only a tiny fraction of phishing emails succeed, the attacker may break even. Cybersecurity must similarly achieve economies of scale: global intelligence sharing, AI based automation, and security as a service are necessary. In short, treat cybercrime as an economic competition. If defenders can make attacks expensive through fraud monitoring, multi layer authentication, and risk sharing effectively raising attackers' costs the ROI equation flips.

For executives and boards, these stats underscore the shift from if to when. The CaaS economy means every company is a potential victim at scale. Metrics like average breach cost and incident frequency should be tracked like key performance indicators. The rise of AI driven attacks means cyber risk management must evolve into AI risk management. Lastly, collaboration with law enforcement and policymakers is crucial: targeting the cryptocurrency rails mixers, lax exchanges and raising the legal risks for participants can inflate the CaaS cost structure. The goal: force the criminal ROI negative. Until then, the cybercrime tax of trillions will persist.

Best Practices

Based on the current CaaS landscape, organizations should adopt a multi layered strategy:

1. Harden the Target: Implement Zero Trust micro-segmentation and network isolation to limit what attackers can access if they breach perimeter defenses. Use penetration testing to validate whether segmentation, remote-access controls, and privilege boundaries resist realistic attack paths. Apply least privilege for user accounts and monitor for unusual administrative behavior.
2. Secure Access & Credentials: Enforce multi factor authentication preferably non phishable, e.g. hardware keys or passkeys. Regularly audit VPNs, RDP, and remote access logs. Because stolen credentials are so common credential abuse was the initial access vector in 22% of breaches in Verizon's 2025 DBIR and appeared at some stage in 39% of breaches in the 2026 edition, use password vaults and threat intel feeds to detect reuse of corporate credentials in breaches.
3. Invest in AI Enabled Detection: Leverage AI/ML for anomaly detection and threat hunting. Automated analytics can cut detection time from months to days. As IBM notes, organizations using AI/automation extensively cut breach costs by about $1.9M on average in 2025 and $1.93M in 2026. Using AI to filter phishing and scan for deepfakes, many email gateways now integrate generative AI checks.
4. Backup & Recovery Preparedness: Maintain offline and immutable backups of all critical data. Test recovery procedures regularly. Sophos data shows ~97% of organizations with encrypted data recovered it in 2025, and in the 2026 survey 66% restored from backups, making recovery the norm, not ransom payment. Frequent backups neutralize single layer extortion.
5. Phishing Resilience: Conduct regular phishing awareness training with real world simulations. Use email filtering DKIM/SPF/DMARC, URL sandboxing, and real time scanning. Prepare for MFA bypass attacks by deploying phishing resistant MFA methods FIDO2, hardware tokens and anomaly based login detection.
6. Monitor Dark Web & Threat Feeds: Subscribe to threat intelligence on emerging malware and IAB offerings. Early detection of leaked credentials or RDP accesses via IAB listings allows preemptive password resets. Use cyber threat hunts to look for Indicators of Compromise from known RaaS groups.
7. Incident Planning & Insurance: Develop tested IR playbooks, including communication plans for double extortion leaks. Ensure cyber insurance is up to date and conditions offline backups, endpoint protection are met to qualify coverage. Insurers are shifting to incentivize prevention and demonstrate controls to reduce premiums.
8. Supply Chain Vetting: Scrutinize third party risk. Enforce contractual security standards on vendors, especially MSPs. Continuously monitor third party software dependencies e.g. promptly patch Log4j style flaws.
9. Regulatory Compliance as Defense: Treat regulations GDPR, NIS2, CCPA not just as burdens but leverage them. For example, transparent breach disclosure can erode the value of stolen data making extortion less effective. Collaborate with law enforcement on tracing criminals blocklisting wallets.

FAQs

• What is Cybercrime as a Service CaaS?

CaaS is the professional underground model where criminal tools, malware, exploit kits and ransomware services, phishing campaigns, and DDoS booter services are sold or rented on the dark web. It allows even low skilled criminals to launch high end attacks by subscribing to these services.

• How big is the global CaaS market?

While precise figures are hard to obtain, Cybersecurity Ventures estimated all cybercrime would cost about $10.5 trillion in 2025, rising toward about $12.2 trillion by 2031. CaaS is a major component of this, effectively an illegal service market. For comparison, if cybercrime were a country it would rank as the world's third-largest economy after the U.S. and China. The CaaS market selling access, malware subscriptions, and stolen data is a large and growing slice of this total.

• What is Ransomware as a Service RaaS?

RaaS is a model where ransomware developers lease their malware and sometimes negotiate with victims to affiliates in exchange for a cut of the ransom. It's like SaaS: affiliates pay rent for a ransomware strain and tools, then keep most of each ransom payment while the developer takes a share. This lets even non technical criminals carry out extortion. RaaS has industrialized extortion, new kits appear constantly, and groups offer 24/7 customer support to victims.

• How prevalent is phishing/BEC in CaaS?

Extremely prevalent. IBM's 2025 report found phishing was the most common initial attack vector, at 16% of data breaches. Business Email Compromise, a form of increasingly AI enhanced phishing, accounts for a high portion of financial losses: the FBI IC3 recorded $3.05B in BEC losses in 2025, up from $2.77B in 2024. Verizon's 2026 DBIR found credential abuse in 39% of breaches at some stage. Phishing kits and Inbox as a service platforms can launch millions of lures at a time.

• What role does cryptocurrency play?

Crypto is the lifeblood of CaaS: it's how criminals receive ransom payments and pay for tools anonymously. Chainalysis estimates illicit addresses received at least $154 billion in 2025, a record driven largely by sanctioned entities, though still below 1% of on chain volume. Stablecoins have overtaken Bitcoin for criminal transfers, accounting for 84% of illicit volume, because their price is stable during laundering. CaaS actors use mixers, cross chain bridges, and offshore exchanges to hide trails. Large hacks e.g. the $1.5B Bybit theft, and ransomware payments of about $820M in 2025 (down from $892M in 2024), underscore crypto's role.

• Are cyber insurance and regulations helping?

Yes and no. Regulations e.g. GDPR, NIS2, SEC rules are raising the stakes and encouraging better security, which indirectly makes CaaS more costly for criminals if breaches become more detectable or less payable. Cyber insurers now demand stringent controls: a lapse e.g. no MFA, no offline backup can void coverage. IBM's 2025 report found 63% of ransomware victims refused to pay, up from 59% in 2024, and Coveware's payment rate fell to about 20% in late 2025, suggesting both regulations and better defenses are paying off. However, insurance gaps mean breaches still hurt companies severely financially.

• What is the outlook through 2030?

CaaS is expected to remain a persistent, evolving economy. Projections to 2030 include:

• AI driven noise attacks: Everyday attacks automated phishing, scanning, minor ransomware will become almost fully automated, targeting SMBs and individuals at scale.
• Elite, targeted campaigns: State sponsored or professional groups will plan high skill attacks on critical infrastructure, government, and Fortune 500s, possibly with geopolitical motives or large payouts.
• Continuous growth: Cybersecurity Ventures expects global cybercrime costs to plateau around $12.2 trillion by 2031. Attack volume will keep rising, especially as generative AI tools e.g. WormGPT, Deepfakes become more accessible to criminals.
• Defense in depth: On the other hand, defenders will increasingly adopt AI and Security as a Service models, shifting the economics. The goal for security leaders is to make attacks more expensive than they're worth.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.