The Russian underground market is consolidating the model of sale known as malware-as-a-service, a growing number of illicit products and hacking activities are available for rent. Like every market, also Russian underground has its own specialty, the sale of TDSs and traffic direction and PPI services.

This model allows many more entities to have access to a given vulnerability without the risk of the vulnerability becoming known and therefore potentially fixed in the near term.