ZeroFox Intelligence Brief - The Evolution of the Cybercrime-as-a-Service Market

Product Serial: B-2026-07-27a

TLP:CLEAR

In this brief, ZeroFox researchers report on the evolution of cybercrime-as-a-service between 2016-2026.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here

Key Findings

Over the past decade, cybercrime has almost certainly reorganized from largely self-contained intrusions into a specialized service economy in which discrete capabilities are bought and sold as products.
Ransomware-as-a-service (RaaS) very likely became the commercial center of this ecosystem, professionalizing through successive brands into affiliate operations with profit-sharing, recruitment, technical support, and brand management.
Extortion tradecraft escalated from simple encryption to “double extortion”: pairing encryption with the threat to publish stolen data. This was popularized around late 2019 and subsequently adopted across the RaaS landscape, often with dedicated data-leak sites and additional pressure tactics.
The service model extended far beyond ransomware into phishing-as-a-service, initial access brokering, infostealer subscriptions, malware delivery, and distributed denial of service (DDoS)-for-hire, all supported by dark web markets, bulletproof hosting, and cryptocurrency laundering infrastructure.
A sustained, multinational law-enforcement campaign repeatedly disrupted the ecosystem—yet resilience and rebranding were the recurring response, with several operations re-emerging within days to months.
Generative artificial intelligence (GenAI) is an emerging accelerant rather than a demonstrated transformation. Criminal AI tooling appeared in mid-2023, and threat actors are very likely adopting AI faster than defenders can adapt to it. However, ZeroFox assesses the publicly available, corroborated evidence does not yet support specific claims about the scale of AI-driven growth.