Desolator operates as a Ransomware-as-a-Service (RaaS) entity, first documented in mid-2025. This group distinguishes itself through fast-moving and opportunistic attacks across various sectors, employing an affiliate recruitment model advertised on dark web forums. Although Desolator has claimed to avoid targeting hospitals and non-governmental organizations, their operational patterns do not consistently reflect this stated policy.