DataKeeper emerged in February 2018 as a Ransomware-as-a-Service (RaaS) offering, distinguishing itself by providing a free sign-up and immediate access to generate weaponized binaries for affiliates on the Dark Web. Its primary motivation is financial gain through extortion. The group stands apart from other RaaS operations by deploying a ransomware variant that uses a four-layered obfuscation technique, employs dual AES and RSA-4096 encryption without adding file extensions to compromised files, and utilizes PsExec for lateral movement within targeted networks, which was an unusual characteristic for .NET-based ransomware at the time. The RaaS platform also uniquely allowed affiliates to configure specific file types for encryption and set custom ransom amounts, fostering uncertainty for victims regarding the extent of their data loss.