Ransomware-as-a-service (RaaS)
Developers lease ransomware and infrastructure to affiliates for a revenue share
categoryMalwareseverityVery HighdetectabilityHighlabnot yet measured
Example: LockBit; Akira 22.6% of incidents (Sophos 2026)
Classification
32 values: 18 imported, 1 derived, 13 machine-classified. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | Medium |
| Resources required | Medium |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | Very High |
|---|---|
| Impact | Availability |
| Platform | ESXiIaaSLinuxmacOSPREWindows |
| Environment | HybridOn-premises |
| Target asset class | Data storeServer |
| Kill-chain phase (tactic) | ImpactResource Development |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Cloud Storage ModificationCommand ExecutionFile CreationFile ModificationMalware ContentProcess Creation |
Detection & response
Mitigated by 14
- M1040 attack-mitigation
- M1053 attack-mitigation
- M1056 attack-mitigation
D3-CFd3fendD3-CMd3fendD3-CQd3fendD3-DFd3fendD3-FAd3fendD3-FEd3fendD3-FEVd3fendD3-FIMd3fendD3-LFPd3fendD3-RFd3fendD3-RFAMd3fend
Detected by 19
- DET0215 attack-detection-strategy
- DET0845 attack-detection-strategy
0e0255bf-2548-47b8-9582-c0955c9283f5sigma1279262f-1464-422f-ac0d-5b545320c526sigma16124c2d-e40b-4fcc-8f2c-5ab7870a2223sigma2c76a22b-702d-48fd-8fa9-e41e2fe203b3sigma3669afd2-9891-4534-a626-e5cf03810a61sigma36aa86ca-fd9d-4456-814e-d3b1b8e1e0bbsigma41d40bff-377a-43e2-8e1b-2e543069e079sigma4c6ca276-d4d0-4a8c-9e4c-d69832f8671fsigma689308fc-cfba-4f72-9897-796c1dc61487sigma74db3488-fd28-480a-95aa-b7af626de068sigma77df53a5-1d78-4f32-bc5a-0e7465bd8f41sigmab48492dc-c5ef-4572-8dff-32bc241c15c8sigmabd132164-884a-48f1-aa2d-c6d646b04c69sigmacaf02a0a-1e1c-4552-9b48-5e070bd88d11sigmae3f673b3-65d1-4d80-9146-466f8b63fa99sigmaec0722a3-eb5c-4a56-8ab2-bf6f20708592sigmaeee8311f-a752-44f0-bf2f-6b007db16300sigma
Tested by 10
08cbf59f-85da-4369-a5f4-049cffd7709fatomic142752dc-ca71-443b-9359-cf6f497315f1atomic1a01f6b8-b1e8-418e-bbe3-78a6f822759eatomic44b68e11-9da2-4d45-a0d9-893dabd60f30atomic4541e2c2-33c8-44b1-be79-9161440f1718atomic53e6735a-4727-44cc-b35b-237682a151adatomic645f0f5a-ef09-48d8-b9bc-f0e24c642d72atomic649349c7-9abf-493b-a7a2-b1aa4d141528atomic7b8ce084-3922-4618-8d22-95f996173765atomicab3f793f-2dcc-4da5-9c71-34988307263fatomic
Framework references
- Primary source: https://learn.microsoft.com/en-us/security/ransomware/human-operated-ransomware
- attack: T1486 (primary)
- attack: T1588.001
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 78 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1486, attack:T1588.001 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 23 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 85 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)