Cybercrime-as-a-Service: Market Size and Growth

• $10.5 Trillion Annual Cost: Global cybercrime losses are projected to reach about $10.5 trillion by 2025 15% YOY growth, making it one of the largest shadow economies.
• Ransomware Exploitation: Ransomware is now in ~44% of breaches. By late 2025 the volume of attacks had surged even as success rates fell, only 23% of victims paid in Q3 2025 down from 85% in 2019.
• Exploit as a Service: Initial Access Brokers IABs listed access to companies with combined revenues exceeding $3 trillion in 2024. The IAB market itself listing prices exceeded $6.3 million in 2024.
• Phishing & BEC: Phishing remains the #1 attack vector: IBM finds 16% of breaches involve phishing the highest share, with an average breach cost of about $4.8M US $9-10M. 90% of cyber breaches begin with phishing or stolen credentials.
• AI/Automation: 16-20% of incidents now involve generative AI phishing, deepfakes. AI driven attacks e.g. deepfake CEO fraud at Arup cost $25M are surging. Microsoft reports customers face 600 million attacks per day. On the defense side, AI automation in SOCs can save ~$2.2M per breach and cut detection time by 80+ days.
• Cost per Breach: IBM reports the global average breach cost was $4.44M in 2025 down from $4.88M. In the U.S. it is $10.22M the highest of any country, over double the global average. By industry, Healthcare remains highest ~$7.42-10.93M; Financial/tech ~$5.5-6M; Retail/public sector lowest ~$2-3M.
• Regional Trends: North America sees ~47% of ransomware attacks, US industry losses, FBI IC3: 859,000 complaints and $16B in losses in 2024. Europe’s GDPR regime makes data extortion potent EU avg breach ~$4-4.5M. APAC is fastest growing in crypto usage, fueling CaaS volume. Latin America’s ransomware attacks jumped by ~70% in 2024 by contrast to ~8% in North America, attractive targets as defenses hardened in wealthier markets.
• Encryption, Crypto & Dark Web: Cryptocurrencies power CaaS: $51B crypto received by illicit addresses in 2024 ≈0.14% of on chain volume. Stablecoins USDT/USDC now comprise 63% of illicit volume. Mixers and chain hopping keep ~$60B+ criminal crypto assets in circulation. The dark web economy prices stolen data cheaply US Social Security # ~$1-6, full ID fullz ~$20-100 but sells high value domain admin access in the tens of thousands.
• DDoS as a Service: Attack volume exploded Cloudflare blocked 20.5M DDoS attacks in Q1 2025 358% YoY increase, and by Q3 had over 36M attacks 8.3M in Q3 alone. Emerging botnets e.g. Aisuru, >1-4M IoT hosts generate world record 29.7 Tbps floods. DDoS extortion RDDoS is rising, with 12% of victims receiving ransom threats by late 2024.
• Rising ‘Double/Triple’ Extortion: Data theft now occurs in ~76% of ransomware attacks. When victims have secure backups 97% can recover encrypted data, criminals pivot to double or triple extortion threatening to leak stolen data or launch collateral attacks on customers/partners if ransom isn’t paid. Average costs of extortion incidents have reached ~$5.08M IBM 2025.

Cybercrime as a Service CaaS refers to the industrial scale criminal economy where malicious tools and access are sold or rented like subscriptions. Instead of lone hackers, today’s landscape features professional syndicates offering RaaS Ransomware as a Service, PhaaS Phishing as a Service, IABs, DDoS booters, malware subscriptions, and even AI driven fraud tools. This report quantifies the size, trends, and economics of CaaS in 2025. Cybercrime has become a systemic drag on the global economy by 2025 it is estimated to cost around $10.5 trillion per year larger than the GDP of all but two countries. Such staggering figures underscore why detailed statistics matter: to understand where attackers succeed phishing and RaaS, where defenses still fail, and how the as a service model is democratizing high end attacks. Notable headlines include the record $1.5B crypto hack of Bybit Lazarus Group, 2025 and an unprecedented $75M ransomware payout to a Fortune 50 firm 2024. These shock numbers highlight what efficient underground markets can do: turn a $34 tool subscription into a $25,000 per month fraud scheme, or enable novices to orchestrate $100M heists.

What Are Cybercrime as a Service Statistics?

Think of CaaS stats as market and operational metrics for the underground economy of cybercrime. Instead of legal sales figures, we measure incidents, payments, losses, prices of illicit services, and detection times. For example, the number of ransomware attacks per day, the median ransom amount, and the percentage of victims who pay are key CaaS stats. These stats help illustrate how lucrative the business model is: defenders must stop every attempted breach, a continuous 24/7 challenge, while attackers only need one success. A useful analogy: CaaS is to cybercrime what SaaS is to legitimate software. It breaks down complex malware and attacks into plug‑and‑play services, democratizing access for criminals. For instance, in 2025 one can rent a phishing kit for ~$250/month or an AI deepfake service for a few dollars per minute, turning high skill tasks into cheap commodities.

Global Overview

This overview highlights an economy under intense growth: outpace global GDP growth by double digits. Ransomware’s share of breaches jumped per Verizon and Halcyon, even as fewer victims pay. Defensive spending cannot catch up global cyber defense budgets ~$150B in 2023, heading to $562B by 2032 still lagging the criminal market.

Cost Breakdown

Cybercrime imposes costs at multiple levels. The global average cost of a data breach is now ~$4.44 million 2025, but this masks huge variability. IBM found U.S. breaches average $10.22 M, while countries like the UK/Germany average ~$4 M. Multi country/regulatory fines inflate costs; for example, Europe’s GDPR exposure makes data leaks double extortion especially expensive. The cost of cybercrime includes ransom payments, recovery and remediation expenses, lost business/downtime, and reputational/legal fallout. Notably:

Advanced incident response has pushed average downtime down IBM: ~277 days total lifecycle, but recovery costs remain steep. For instance, Sophos reports ~97% of victims with encrypted data eventually recover mostly via backups, which is good news yet only ~54% could rely solely on backups the rest paid ransoms. The lesson: Investing in backups and detection pays off. Industry differences are stark: IBM finds healthcare breaches averaging ~$7.42M and up to $10.93M in US healthcare, while public sector/education can be as low as ~$2.6M per incident. Finance and tech typically fall in between US financial ~ $5.9M.

Cost Drivers and Trends

• AI & Automation: Organizations deploying AI in SOCs and IR saw ~$2.2M lower breach costs and much faster response times. Conversely, lack of AI preparedness governance, monitoring is a growing vulnerability. Notably, 63% of victims in 2025 report they refused to pay ransomware up from 59% in 2024 demonstrating improved backups and regulations deter payments.
• Double/Triple Extortion: Pre breach preparation e.g. IR, encryption means encryption only attacks are less effective: only 50% of 2025 attacks encrypted data Sophos, the lowest in years. Attackers have shifted to exfiltrate first: Coveware finds 76% of ransomware attacks involved data theft. This evolution has kept extortion profitable: exfiltration only ransom demand pay rate is only 19%, but the potential costs of data breach fines, brand damage have skyrocketed.
• Legal/Regulatory: Global cost includes fines and legal fees. For example, US firms face SEC/DCIP cyber regulations; Europe’s NIS2/GDPR impose multi million penalties. Insurers now demand MFA, zero trust and offline backups. In 2024, ~42% of companies reported insurance reimbursed only a small fraction of a ransomware loss, pushing more firms to invest in prevention.

Attack Vector Distribution

According to recent studies, attacks now blend traditional techniques with advanced tools. The table below shows major initial vectors based on breach surveys and their impact:

Sources: IBM and Ponemon breach reports, Verizon DBIR.

Industry Breakdown

Certain sectors bear disproportionate risk in CaaS:

• Healthcare: By far the most targeted and costly. In the US, average healthcare breach costs ~$10.93M. Globally, IBM reports ~$7.42M, reflecting expensive patient data recovery and life safety stakes. Attackers know hospitals are under political pressure to pay ambulances diverted, surgeries canceled.
• Financial Services: Always a top target due to direct access to money. Costs average ~$5.56M IBM or $5.9M; banks invest heavily in detection. High profile cases include waves of banking trojans and real time payment fraud in LATAM and SEA.
• Technology/Manufacturing: Typically mid range ~$4-5M. Tech firms see many credential stealing/phishing attacks; manufacturing suffers from supply chain and IP theft. The US industrial sector saw notable ransomware disruptions in 2024-25.
• Retail & Public/Government: Lower costs ~$2-3M but high frequency of small breaches, point of sale skimming, identity theft. However, regulatory factors e.g. GDPR fines mean retail and government can still face large penalties for data leaks.

The IoT and Services sectors are increasingly targeted by DDoS as service and botnets. APAC’s financial and crypto industries are also lucrative, as grassroots crypto adoption creates new fraud vectors.

Regional Breakdown

• North America USA/Canada: The top target region. FBI IC3 reported 859,532 complaints in 2024 with $16B in losses. 47% of global ransomware hits businesses here AAG. The US’s high breach costs $10.22M avg reflect greater digital asset value and regulations. US defense spending is highest globally. Cyber insurers and regulators SEC rules, CISA guidelines are leading to higher standards.
• Europe & MENA: Europe faces high fines: GDPR can add 2-4x to ransom costs. Average breach cost ~€3.5-4M in Europe. IBM found Middle East breaches averaging SAR27M ~$7.2M in 2025 18% decline thanks to rapid security investment. The region also sees a surge of sophisticated hacktivism e.g. conflict related attacks targeting energy and supply chains. Security budgets in EMEA are rising, but legacy systems remain a risk.
• Asia Pacific: Fastest growing cybercrime market. Rapid digitization in India, Indonesia, Vietnam expands the attack surface. APAC leads in crypto usage, making it a hotbed for crypto fraud and money laundering Chainalysis reports APAC on chain value 3× since 2022. Notably, DDoS attacks often originate from Asia e.g. botnets in Indonesia. APAC nations are heavily targeted by both state sponsored campaigns and financially motivated CaaS actors.
• Latin America: Emerging front. Ransomware cases jumped ~70% in 2024 compared to ~8% in NA as attackers shift to regions with fewer defenses. Brazil is a hotspot for banking malware and fraud. Cybercrime groups here are professionalizing e.g. RagnarLocker style RaaS strains first seen. Data breach costs are growing, but still below US/EU levels. Cybersecurity awareness is improving, and insurance is less prevalent.

Major Breaches of 2025

While many CaaS incidents go unreported, notable 2024-2025 examples illustrate the scale:

• Lazarus/Bybit Hack Early 2025: North Korea’s state sponsored Lazarus Group stole $1.5 billion in cryptocurrency from the Bybit exchange, setting a new record for a single crypto heist. This demonstrates how national hacker groups leverage CaaS tools like stolen employee credentials to execute massive thefts.
• DarkSide/Colonial Pipeline Clone Mid 2024: A Fortune 50 energy company paid a $75 million ransom to the Dark Angels group after a Colonial like pipeline shutdown scenario. This single payout matches the annual revenue of many SMEs, underscoring Big Game Hunting extortion.
• Arup Deepfake Fraud Feb 2025: An AI deepfake of Arup’s CEO convinced an employee to wire $25 million to criminals. No malware was used; the attacker simply exploited trust via generative AI. This case highlights the new social engineering frontier of CaaS.
• Healthcare Ransomware Surge: In 2024, over 630 confirmed global healthcare ransomware attacks caused average breach costs of $10.93 million each. Victims ranged from hospitals EHR encryption to clinics. In one case, a US hospital group experienced simultaneous double extortion: files encrypted and stolen, pressuring payment under threat of public data dump mirroring trends in 2024.
• Cryptojacking Campaign 2025: A CaaS group ran a phony Android app on Google Play, infecting 200K devices to mine Monero. Profits exceeded $10M in stealth crypto. This illustrates how even "commodity" malware as service cryptojacking kits < $200 can yield large aggregate gains.
• Government Database Leak 2024: An Initial Access Broker sold VPN credentials for a US municipal network for ~$3,000. Attackers used it to infect systems, exfiltrating citizen PII 10M records. The city paid a ransom to prevent public data release, showing IAB leverage on legacy infra.

Emerging Trends

• AI Arms Race: Generative AI fuels both offense and defense. Criminals use AI to create hyper realistic spear phish emails and deepfakes on demand. Notably, AI driven spam campaigns rose to 82% of all phishing in 2025. Defenders are racing to deploy AI based threat hunting: automated anomaly detection, natural language log analysis, and LLMs for IoC triage. Expect hybrid teams where AI augments human analysts saving the ~$2.2M IBM found. Attackers are already experimenting with AI driven polymorphic malware.
• Volume vs. Value: The paradox continues: attackers send much more volume but earn less per victim. As Coveware notes, ransomware payments declined to historic lows 23% pay rate, median demand ~$115K even as some whales pay millions. This bifurcates the market: automated low level RaaS kits vs. elite syndicates targeting enterprises. In response, we see more batch phishing and scanning a relentless flood of probes, while true hand crafted attacks focus on critical infrastructure and wealthy targets.
• Shadow AI & MFA Bypass: The rapid rollout of MFA has criminals developing man in the middle phishing kits that intercept one time codes. For example, the BlackForce and Tycoon kits as noted by Microsoft and The Hacker News allow real time stealing of credentials and MFA tokens. Attackers even sell session cookies enabling silent full account takeover. This cat and mouse will drive defenders toward stronger authentication biometrics, FIDO2 and user behavior analytics.
• Supply Chain & IAB Blurring: The traditional malware supply chain has further fragmented. IABs now routinely target Managed Service Providers and third parties: compromise an MSP, and access dozens of downstream clients. Breaches of SolarWinds, Log4j, and MOVEit have fed the IAB market. Expect more one to many campaigns as supply chain risk remains critical.
• Weaponization of Discord/Tor: CaaS actors increasingly communicate via encrypted chat apps and Tor. New pay for chat support lines Telegram helpdesks and reputation based trust smart escrow are standard. Exit scams still happen on dark markets, but big actors use decentralized networks e.g. Hydra/Abacus style. One trend: crypto hosting services providing bundled laundering + escrow, essentially Money Laundering as a Service.
• Geopolitical Pressures: Sanctions evasion via crypto is a major undercurrent. Chainalysis notes ~33% of illicit volume linked to sanctioned entities e.g. Russian financial networks. We also see nation states indirectly fueling CaaS hacktivist cartels in Eastern Europe both sell services and target Western firms to sow chaos. Ukraine conflict cyber tactics e.g. wiper malware often spill over to criminal markets as DDoS for hire proxies or ransomware DIY.

What These Statistics Mean

The numbers paint a clear strategic picture: Cybercrime has industrialized. Attacks are no longer random blips but a constant, predictable tax on digital business. Organizations must view CaaS not as improbable risk but as a business reality. The low ransom pay rate 23% is good news for defenders paying ransoms is no longer an effective business continuity strategy. Instead, investments must focus on prevention hardening, patching, least privilege and rapid recovery backups, IR playbooks.

The ROI math overwhelmingly favors attackers: tiny costs e.g. $250 for a phishing kit versus outsized returns; a few successful ransoms cover hundreds of those kit costs. Thus, even if only 1% of phishing emails succeed, the attacker may break even. Cybersecurity must similarly achieve economies of scale: global intelligence sharing, AI based automation, and security as a service are necessary. In short, treat cybercrime as an economic competition. If defenders can make attacks expensive through fraud monitoring, multi layer authentication, and risk sharing effectively raising attackers’ costs the ROI equation flips.

For executives and boards, these stats underscore the shift from if to when. The CaaS economy means every company is a potential victim at scale. Metrics like average breach cost and incident frequency should be tracked like key performance indicators. The rise of AI driven attacks means cyber risk management must evolve into AI risk management. Lastly, collaboration with law enforcement and policymakers is crucial: targeting the cryptocurrency rails mixers, lax exchanges and raising the legal risks for participants can inflate the CaaS cost structure. The goal: force the criminal ROI negative. Until then, the cybercrime tax of trillions will persist.

Best Practices

Based on the current CaaS landscape, organizations should adopt a multi layered strategy:

1. Harden the Target: Implement Zero Trust micro segmentation, network isolation to limit what attackers can access if they breach perimeter defenses. Apply least privilege for user accounts; monitor for unusual admin behavior.
2. Secure Access & Credentials: Enforce multi factor authentication preferably non phishable, e.g. hardware keys or mobile push. Regularly audit VPNs, RDP, and remote access logs. Because stolen credentials are so common 15-22% of breaches, use password vaults and threat intel feeds to detect reuse of corporate credentials in breaches.
3. Invest in AI Enabled Detection: Leverage AI/ML for anomaly detection and threat hunting. Automated analytics can cut detection time from months to days. As IBM notes, organizations using AI/automation cut breach costs by ~$2.2M on average. Using AI to filter phishing and scan for deepfakes, many email gateways now integrate generative AI checks.
4. Backup & Recovery Preparedness: Maintain offline and immutable backups of all critical data. Test recovery procedures regularly. Sophos data shows ~97% of organizations can recover their data, but only half relied on backups making recovery the norm, not ransom payment. Frequent backups neutralize single layer extortion.
5. Phishing Resilience: Conduct regular phishing awareness training with real world simulations. Use email filtering DKIM/SPF/DMARC, URL sandboxing, and real time scanning. Prepare for MFA bypass attacks by deploying phishing resistant MFA methods FIDO2, hardware tokens and anomaly based login detection.
6. Monitor Dark Web & Threat Feeds: Subscribe to threat intelligence on emerging malware and IAB offerings. Early detection of leaked credentials or RDP accesses via IAB listings allows preemptive password resets. Use cyber threat hunts to look for Indicators of Compromise from known RaaS groups.
7. Incident Planning & Insurance: Develop tested IR playbooks, including communication plans for double extortion leaks. Ensure cyber insurance is up to date and conditions offline backups, endpoint protection are met to qualify coverage. Insurers are shifting to incentivize prevention and demonstrate controls to reduce premiums.
8. Supply Chain Vetting: Scrutinize third party risk. Enforce contractual security standards on vendors, especially MSPs. Continuously monitor third party software dependencies e.g. promptly patch Log4j style flaws.
9. Regulatory Compliance as Defense: Treat regulations GDPR, NIS2, CCPA not just as burdens but leverage them. For example, transparent breach disclosure can erode the value of stolen data making extortion less effective. Collaborate with law enforcement on tracing criminals blocklisting wallets.

FAQs

• What is Cybercrime as a Service CaaS?

CaaS is the professional underground model where criminal tools, malware, exploit kits and ransomware services, phishing campaigns, and DDoS booter services are sold or rented on the dark web. It allows even low skilled criminals to launch high end attacks by subscribing to these services.

• How big is the global CaaS market?

While precise figures are hard to obtain, analysts estimate all cybercrime will cost ~$10.5 trillion annually by 2025. CaaS is a major component of this, effectively an illegal service market. For comparison, this illicit economy would rank as the world’s 3rd largest GDP. The CaaS market selling access, malware subscriptions, and stolen data is on the order of billions per year, growing rapidly.

• What is Ransomware as a Service RaaS?

RaaS is a model where ransomware developers lease their malware and sometimes negotiate with victims to affiliates in exchange for a cut of the ransom. It’s like SaaS: affiliates pay rent for a ransomware strain and tools, then keep ~70% of each ransom payment dev takes ~30%. This lets even non technical criminals carry out extortion. RaaS has industrialized extortion, new kits appear constantly, and groups offer 24/7 customer support to victims.

• How prevalent is phishing/BEC in CaaS?

Extremely prevalent. IBM and industry reports show phishing causes around 16% of data breaches, the single largest attack vector. Business Email Compromise, a form of AI enhanced phishing accounts for a high portion of financial losses FBI IC3: BEC lost $2.4B in 2024. In practice, about 90% of breaches begin with a phishing email or stolen credential. Phishing kits and Inbox as a service platforms can launch millions of lures at a time.

• What role does cryptocurrency play?

Crypto is the lifeblood of CaaS: it’s how criminals receive ransom payments and pay for tools anonymously. Around $51 billion in cryptocurrency 0.14% of on chain volume was received by illicit addresses in 2024. Stablecoins USDT/USDC have overtaken Bitcoin for criminal transfers ~63% of illicit volume because their price is stable during laundering. CaaS actors use mixers, cross chain bridges, and offshore exchanges to hide trails. Large hacks e.g. $1.5B Bybit, $813M in ransomware paid in 2024 underscore crypto’s role.

• Are cyber insurance and regulations helping?

Yes and no. Regulations e.g. GDPR, NIS2, SEC rules are raising the stakes and encouraging better security, which indirectly makes CaaS more costly for criminals if breaches become more detectable or less payable. Cyber insurers now demand stringent controls: a lapse e.g. no MFA, no offline backup can void coverage. In 2024, 42% of companies said insurance covered only a small part of ransomware losses, pushing them to invest in prevention. Overall, the shrinking ransom pay rate 23% suggests both regulations and better defenses are paying off. However, insurance gaps mean breaches still hurt companies severely financially.

• What is the outlook through 2030?

CaaS is expected to remain a persistent, evolving economy. Projections to 2030 include:

• AI driven noise attacks: Everyday attacks automated phishing, scanning, minor ransomware will become almost fully automated, targeting SMBs and individuals at scale.
• Elite, targeted campaigns: State sponsored or professional groups will plan high skill attacks on critical infrastructure, government, and Fortune 500s, possibly with geopolitical motives or large payouts.
• Continuous growth: Global cybercrime costs could exceed $12 trillion by 2031. Attack volume will keep rising, especially as generative AI tools e.g. WormGPT, Deepfakes become more accessible to criminals.
• Defense in depth: On the other hand, defenders will increasingly adopt AI and Security as a Service models projected $55.7 billion market by 2033, shifting the economics. The goal for security leaders is to make attacks more expensive than they’re worth.

About the Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.