Tier 1
Commodity ransomware / RaaS affiliates
Resources / capability
Moderate — purchased initial access from access brokers, RaaS kits with playbooks. Some targeting (sector preference, size).
Typical targets
Under-resourced mid-market — healthcare systems, school districts, manufacturing, municipalities.
Most relevant defenses
- MDR
- EDR
- identity
- backup / recovery
- exposure management
Note · The breach class that makes the news in mid-market. Recovery cost dominates the loss, not data theft.