DarkRaaS emerged in October 2024 as an initial access broker and data broker, primarily operating under a ransomware-as-a-service (RaaS) model. The group specializes in selling unauthorized network access and exfiltrated data on underground forums like BreachForums, driven by financial gain, though its targeting of Israeli entities has also suggested a geopolitical, anti-Western stance. Initially, DarkRaaS focused on providing access to compromised systems but indicated a potential shift towards full ransomware deployment and double extortion tactics. The group notably rebranded its forum presence to "bashify" in November 2024, distinguishing its operations from the earlier DarkSide ransomware group with which it claimed a questionable affiliation.