Why the file, not the malware family, is the control point that matters to your board.
The Business Problem in One Sentence
Ransomware-as-a-Service and Malware-as-a-Service operators have industrialized cybercrime, yet their entry point has not changed. Across dozens of distinct criminal enterprises, with different payloads, different infrastructure, and different affiliates, the overwhelming majority of successful intrusions begin the same way: a file arrives, a person opens it, and the organization loses control of the outcome. Every dollar of downstream security spending is an attempt to recover from that single moment.
This matters to executives because it reframes the investment question. Security budgets are frequently allocated toward faster detection, deeper telemetry, and shorter response times, all of which are measures of how quickly an organization recognizes that it has already been breached. Prevention at the file layer changes the economics by removing the breach event itself rather than accelerating the cleanup.
The Threat Landscape at a Glance
The operations below represent the most consequential MaaS and RaaS enterprises observed over recent years. They compete with one another, they operate independently, and they differ substantially in technical sophistication. What they share is a delivery model.
| Operation | Model | Payload | Typical Initial Access |
|---|---|---|---|
| LockBit | RaaS | LockBit ransomware | Phishing with ZIP, ISO, OneNote, or Office attachments; stolen VPN and RDP credentials; exposed service exploitation; malicious scripts |
| Qilin (Agenda) | RaaS | Qilin ransomware | Phishing attachments, counterfeit installers, malicious archives, internet-facing application exploitation, credential theft |
| Akira | RaaS | Akira ransomware | VPN compromise, phishing documents, malicious ZIP archives, vulnerable remote access appliances |
| Play | RaaS | Play ransomware | Vulnerability exploitation, phishing attachments, remote administration abuse, DLL sideloading |
| RansomHub | RaaS | RansomHub | Email attachments, downloaded installers, compromised credentials, unpatched server exploitation |
| Black Basta | RaaS | Black Basta | Malicious Office files, QakBot infections, phishing archives, counterfeit browser updates |
| DragonForce | RaaS | DragonForce ransomware | Phishing emails, stolen credentials, vulnerable VPN gateways, malicious PowerShell loaders |
| Medusa | RaaS | Medusa ransomware | Email attachments, exposed RDP, malicious installers, known vulnerability exploitation |
| INC Ransom | RaaS | INC ransomware | Phishing documents, compromised credentials, vulnerable edge devices, malicious scripts |
| Lynx | RaaS | Lynx ransomware | Email-delivered archives, counterfeit updates, public-facing service exploitation |
| QuimaRAT | MaaS | Cross-platform Java RAT | Builder-generated EXE, JAR, MSI, APP, and shell scripts delivered through phishing, malicious downloads, and trojanized installers |
| Lumma Stealer | MaaS | Information stealer | Counterfeit CAPTCHA pages (ClickFix), malicious ZIP archives, cracked software, browser update lures, phishing attachments |
| RedLine Stealer | MaaS | Credential stealer | Cracked software, malicious documents, counterfeit installers, phishing campaigns, Discord and CDN downloads |
| Raccoon Stealer | MaaS | Credential stealer | ZIP archives, ISO images, phishing emails, trojanized installers, counterfeit browser updates |
| DarkGate | MaaS | Loader and RAT | Microsoft Teams abuse, PDF lures, MSI installers, AutoIt scripts, malicious Office documents |
| Remcos RAT | MaaS | Remote access trojan | VHD and VHDX images, ISO files, Office macros, LNK shortcuts, archive files |
| AsyncRAT | MaaS | Remote access trojan | Phishing attachments, compressed archives, JavaScript and VBScript downloaders, Office documents |
| Agent Tesla | MaaS | Credential stealer | Office documents, PDFs with embedded downloaders, compressed archives, malicious installers |
| Snake Keylogger | MaaS | Keylogger | Email attachments, Office files, ZIP archives, MSI packages |
| XWorm | MaaS | Remote access trojan | ISO files, OneNote documents, phishing emails, malicious scripts, counterfeit installers |
The Delivery Layer Is the Common Denominator
When the delivery mechanisms are separated from the payloads, the picture becomes considerably simpler. The same handful of file formats appear across virtually every operation, regardless of who is behind it.
| Delivery Format | Operations Using It |
|---|---|
| ZIP, RAR, and 7z archives | Nearly every MaaS and RaaS operator |
| ISO, IMG, VHD, and VHDX disk images | LockBit, Remcos campaigns, DarkGate, Black Basta |
| Office documents (Word, Excel, OneNote) | Qilin, Black Basta, AsyncRAT, Agent Tesla |
| PDF documents | DarkGate, Agent Tesla, broad phishing campaigns |
| JavaScript and VBScript | AsyncRAT, DarkGate, Lumma, Remcos |
| Windows shortcut (LNK) files | Remcos, Lumma, Black Basta, DarkGate |
| MSI installers | QuimaRAT, Lumma, DarkGate |
| Executables disguised as documents | Almost all MaaS operations |
| HTA and HTML loaders | Lumma, DarkGate, ClickFix campaigns |
| Password-protected archives | LockBit, Akira, Qilin, Lumma, RansomHub |
| Counterfeit browser and software updates | Lumma, RedLine, DarkGate, Raccoon |
One Attack Pattern, Repeated Endlessly
Strip away the branding and the affiliate structures, and nearly every successful campaign follows an identical sequence.
This is why sophisticated operators now invest more heavily in delivery than in the malware itself. The initial file must defeat email security, endpoint protection, and human suspicion before a single line of payload code ever runs. Everything after that step is comparatively easy for the attacker. The consequence is an arms race conducted almost entirely inside trusted document formats, nested archives, virtual disk images, shortcut files, and legitimate-looking installers.
For an executive, the strategic implication is direct. If the file is where the attack is won or lost, then the file is where the control belongs.
A less visible consequence of AI-assisted malware development is a sharp increase in the reuse of functional code patterns across otherwise unrelated malware families. Rather than hand-building every component, threat actors now rely on generative models to produce code for small, well-defined tasks: ClickFix execution, downloader validation, payload extraction, process injection, persistence establishment, command-and-control communication. Because these models tend to converge on similar implementations for identical objectives, unrelated malware families increasingly share the same behavioral building blocks even when their overall codebases have nothing in common.
This is an acceleration of a familiar trend rather than a break from it. Earlier malware authors assembled new threats from public toolkits, open-source projects, and leaked source code, which produced recurring instruction sequences across families. Generative AI compresses that timeline dramatically, producing functionally equivalent code on demand, often expressed through different APIs, different scripting languages, or different encoding techniques while performing the same malicious action.
The critical insight is that these functional code patterns survive the discovery of entirely new vulnerabilities. A newly found flaw changes where an attacker gains a foothold, not what the attacker must do once inside. Whatever the entry point, the malware still has to unpack its payload, execute code in a hostile process space, establish persistence, and reach its operator. Those requirements are dictated by the operating system, not by vulnerability, which means the same generated building blocks are simply recomposed around the new target. A zero-day rearranges the front door. It does not rewrite the machinery behind it.
The practical result for defenders is a volume problem that detection-based tooling cannot win. Every new variant is genuinely new to a signature engine, even when it is behaviorally identical to something the industry has understood for years. Organizations that depend on recognizing known threats are structurally committed to always being behind, and each newly disclosed vulnerability resets that clock in the attacker’s favor rather than the defenders.
How FileDNA Changes the Calculation
FileDNA‘s proprietary Content Analysis, Disarm and Reconstruction (CADR) technology is built for exactly this reality. Rather than searching for signatures or specific byte sequences, the engine evaluates what a file is structurally capable of doing. It recognizes the many alternative implementations of the same underlying operation, whether expressed through different API combinations, scripting constructs, encoded payloads, or execution paths, all of which produce an equivalent malicious outcome.
By focusing on structural behavior instead of malware identity, FileDNA is capable of preventing not only previously known threats, but also newly, even not-yet generated AI-assisted malware variants that reuse the same fundamental attack techniques in different forms.
This is a meaningful distinction at the board level. A detection-based strategy is a commitment to funding an indefinite cycle of discovery, signature distribution, and incident response, with exposure in every gap between them. A prevention-based strategy at the file layer removes the class of threat rather than the individual instance.
The behavioral, structure-centric approach that CADR takes makes it inherently resilient against polymorphic malware, AI-generated code variation, and malware families that have not yet been written. Implementation details will keep changing. The underlying malicious objectives do not.
The Executive Takeaway
Three conclusions follow from the evidence above. First, the diversity of the threat landscape is largely superficial; the delivery layer is remarkably uniform. Second, generative AI guarantees that the number of unique malware variants will continue to grow faster than any detection catalog can track. Third, and most importantly, none of this changes the fundamental point of entry.
The file remains the front line. Securing it is the highest-leverage decision available to a security organization, and it is one of the few investments in cybersecurity whose value increases rather than decays as attacker capability improves.