The president says the U.S. will respond if it keeps getting hit with cyberattacks linked to Russia. But Putin has shown little interest in combatting cyber crimes called ransomware-as-a-service.

Transcript

AUDIE CORNISH, HOST:

President Biden called for a crackdown on cyberattacks at his summit yesterday with Vladimir Putin, but the Russian leader has shown little interest in combating an emerging criminal industry in his country that's called ransomware as a service. You can think of it as an ecosystem comprised of small groups of hackers with a range of specialized skills who find each other in the dark corners of the internet. NPR's Greg Myre breaks it down for us.

GREG MYRE, BYLINE: If you want to extort millions of dollars from a large U.S. company, you can't do it alone. It takes a village, a village of hackers with advanced computer skills who hang out on the dark web and most likely live in Russia.

DMITRI ALPEROVITCH: Ransomware has become a huge business. And as any business, in order to scale it, they're coming up with innovative models.

MYRE: Dmitri Alperovitch is head of the technology group Silverado Policy Accelerator. He says this model is ransomware as a service and includes three key players. The top tier is made up of small gangs. They make the sophisticated malware that locks up the computer systems that targeted companies. He estimates a dozen or so of these groups are doing this on a large scale. The best-known include DarkSide, blamed for the attack on Colonial Pipeline, and REvil, accused in the hack of the meat supplier JBS. But he adds...

ALPEROVITCH: The people that are building the software are not actually the ones, most of the time, that are going to use it. They're going to recruit others.

MYRE: Wendi Whitmore of the cybersecurity firm Palo Alto Networks says these malware-makers figured out it's more lucrative to disseminate their crippling software more widely through a second key group known as affiliates.

WENDI WHITMORE: What they're doing is outsourcing parts of the supply chain, essentially, and then giving these organizations that they work with a cut of the profits.

MYRE: The affiliates do much of the actual work. They launch the malware attack, demand the ransom, negotiate with the victim company and collect the money - almost always in a cryptocurrency like Bitcoin. As a result, the affiliates usually keep most of the money - often 75% or more. Still, the affiliates can't unleash these strikes unless they first gain access to a company's computer network. This brings us to the third key group - the old-fashioned hackers or access brokers who find a way in. If you need these guys, you'll find them on the dark web.

ADAM MEYERS: You go into the underground forums and there's this whole category of threat actor we call an access broker.

MYRE: Adam Meyers is with the cybersecurity company CrowdStrike.

MEYERS: And what they do all day is hack into different businesses. And then they advertise that access. You want into company X? It's $4,000.

MYRE: A small price to pay if that access leads to a multimillion-dollar ransom - of course, all these relationships require a lot of trust among criminals hiding behind online pseudonyms.

ALPEROVITCH: How do you trust someone who is fundamentally untrustworthy, who is fundamentally a thief?

MYRE: Again, Dmitri Alperovitch.

ALPEROVITCH: It's very difficult to get into these criminal forms. You kind of have to prove that you're a criminal by committing some act of cybercrime and validate that you're not law enforcement. That's been a huge problem for them in the past.

MYRE: At Wednesday's summit between Biden and Putin in Geneva, the American president said he would respond if the U.S. continues to be hit, especially in a critical industry like energy supplies or the water system.

(SOUNDBITE OF ARCHIVED RECORDING)

PRESIDENT JOE BIDEN: Responsible countries need to take action against criminals who conduct ransomware activities on their territory.

MYRE: Putin could tell the Russian hackers to cut it out, says Alperovitch.

ALPEROVITCH: They're not part of his inner circle. They're not, you know, generating any significant revenue for the Russian state. So this is the one issue that, if pressed on, Putin can actually give on.

MYRE: So will he? Biden says he expects the answer to be clear within a few months. Greg Myre, NPR News.

(SOUNDBITE OF THE FLAMING LIPS SONG, "ARE YOU A HYPNOTIST??") Transcript provided by NPR, Copyright NPR.