Ransomware gangs increasingly use their own or stolen computer code, moving away from a ransomware-as-a-service model that made their activities easier to monitor, new research shows.