TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

DarkOwl

What is Ransomware as a Service?

DarkOwl Content Team · 2026-03-19 · Read original ↗

ATT&CK techniques detected

16 predictions
T1486Data Encrypted for Impact
99%
“what is ransomware as a service? march 19, 2026 cybersecurity might as well have its own language. there are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security fiel…”
T1486Data Encrypted for Impact
97%
“##ble criminal ecosystem. today, ransomware can be purchased, deployed, and monetized through a model known as ransomware - as - a - service ( raas ). it is a business model for cybercriminals to hire ransomware operators to launch ransomware attacks on their behalf. darkowl rese…”
T1486Data Encrypted for Impact
95%
“raas toolkit. ransomware groups often operate similarly to legitimate businesses, complete with recruitment processes, internal management tools, and operational dashboards used to track victims and ransom payments. darkowl analysts often find “ starter kits ” for sale on darknet…”
T1486Data Encrypted for Impact
94%
“##ware groups, claiming 593 victims by the end of the year. ransomhub ’ s affiliate program has been prolific over taking established groups, such as lockbit, in the number of victims they have. notably, ransomhub was responsible for a significant breach of the u. s. healthcare p…”
T1486Data Encrypted for Impact
86%
“, run by criminal gangs, and threat actors to detect mentions of criminal activity against an organization. search parameters enable queries by company website, company name, contact name, or other proximity indicators such as products, brands, or other intellectual property. aut…”
T1585.002Email Accounts
84%
“raas toolkit. ransomware groups often operate similarly to legitimate businesses, complete with recruitment processes, internal management tools, and operational dashboards used to track victims and ransom payments. darkowl analysts often find “ starter kits ” for sale on darknet…”
T1486Data Encrypted for Impact
80%
“as alphv, blackcat emerged in 2021 and quickly gained attention for being written in the rust programming language. the group implemented a public data - leak site that indexed stolen files, increasing pressure on victims to pay ransom demands. protection and mitigation ransomwar…”
T1585.002Email Accounts
71%
“##ware groups, claiming 593 victims by the end of the year. ransomhub ’ s affiliate program has been prolific over taking established groups, such as lockbit, in the number of victims they have. notably, ransomhub was responsible for a significant breach of the u. s. healthcare p…”
T1585.002Email Accounts
71%
“what is ransomware as a service? march 19, 2026 cybersecurity might as well have its own language. there are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security fiel…”
T1486Data Encrypted for Impact
63%
“stolen password alone won ’ t grant access. patches and updates : keep everything current — laptops, phones, browsers, and even routers / iot. updates patch known flaws attackers actively exploit. criminals look for “ holes ” in outdated software. phishing awareness & training : …”
T1585.002Email Accounts
62%
“##ble criminal ecosystem. today, ransomware can be purchased, deployed, and monetized through a model known as ransomware - as - a - service ( raas ). it is a business model for cybercriminals to hire ransomware operators to launch ransomware attacks on their behalf. darkowl rese…”
T1585.002Email Accounts
59%
“, run by criminal gangs, and threat actors to detect mentions of criminal activity against an organization. search parameters enable queries by company website, company name, contact name, or other proximity indicators such as products, brands, or other intellectual property. aut…”
T1588.001Malware
50%
“what is ransomware as a service? march 19, 2026 cybersecurity might as well have its own language. there are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security fiel…”
T1588.001Malware
33%
“, run by criminal gangs, and threat actors to detect mentions of criminal activity against an organization. search parameters enable queries by company website, company name, contact name, or other proximity indicators such as products, brands, or other intellectual property. aut…”
T1657Financial Theft
33%
“##ware groups, claiming 593 victims by the end of the year. ransomhub ’ s affiliate program has been prolific over taking established groups, such as lockbit, in the number of victims they have. notably, ransomhub was responsible for a significant breach of the u. s. healthcare p…”
T1080Taint Shared Content
32%
“what is ransomware as a service? march 19, 2026 cybersecurity might as well have its own language. there are so many acronyms, terms, sayings that cybersecurity professionals and threat actors both use that unless you are deeply knowledgeable, have experience in the security fiel…”

Summary

In this blog series, we explain and simplify some of the most commonly used terms. In this edition, we dive into ransomware as a service.

The post What is Ransomware as a Service? appeared first on DarkOwl, LLC.