This DarkSide ransomware technical analysis report covers a ransomware-as-a-service group first seen in August 2020. The group, thought to be based in Russia, uses double extortion: it encrypts data and threatens to publish it. Its best-known attack hit Colonial Pipeline in the US. The report explains how the malware works, how it infects systems, and which detections and IoCs matter.
(…) The DarkSide ransomware has been identified as a cybercrime gang thought to be based in Russia, especially targeting the US and Eastern European corporations. Also, they leverage ransomware in their campaign. They had targeted energy, financial, and so on sectors. But targets do not include hospitals, government institutions, schools, or non-profit organizations. DarkSide was first seen in August 2020. Also, their loudest operation is known as Colonial Pipeline in the US.
The DarkSie threat group has also been using the Double Extortion attack model. It is standardized between ransomware gangs to enforce organizations with disaster recovery plans that refuse to pay the ransom. Therefore, if the victim accomplishes recovering encrypted data, they still have to pay to avoid publicly sharing data
The DarkSide exhibits aggressive behavior for their targets to pay the ransom, dispositions to send emails to the employee if they think to get ignored or their victims did not respond themselves in 2-3 days. If this method is not working, they will not hesitate to tell by calling high-level executives. In this way, threat actors will notify the victim customers or press about the ransomware attack.
The DarkSide ransomware gang has been sold ransomware as RaaS modeling in underground cybercrime forums. This situation enables to conduct of campaigns without technical requirements(…)
What You Will Find In This Report?
Learn Technical Method of Operation Details
The technical details of the DarkSide Ransomware and its abilities, infection methodologies, and more. The report will show many points about the ransomware’s technical details, detections, and IoCs.
Gain Knowledge About Future Attacks
By understanding its attack model, you can make more informed predictions about the future of cybersecurity. Stay up-to-date with the latest trends and keep your business from potential threats.
Response & Mitigation Tactics From Experts
Brandefense analysts share practical response and mitigation advice on this topic. Darkside has been increasingly active and sophisticated in recent years, making it more difficult for companies to protect themselves.
What Does the DarkSide Ransomware Analysis Report Cover?
The report is 24 pages long. It is dated 25 July 2021. Its chapters are Overview, Targeted Countries and Sectors, DarkSide Attack Lifecycle, MITRE ATT&CK, Conclusion and Indicators of Compromise.
What Does the Report Say About the Group?
- The Overview gives a campaign timeline from August 2020 to the Colonial Pipeline attack in May 2021.
- It says Colonial Pipeline paid a $4.4 million ransom and that the FBI confirmed DarkSide was behind the attack.
- It says the group sold its ransomware as a service, so lifecycles can differ from one operation to the next.
- The group does not target healthcare, education, non-profit or government organizations, according to the report.
- It says DarkSide checks system language settings to avoid certain countries, and that its code resembles REvil ransomware.
What Technical Findings Does the Attack Lifecycle Chapter Give?
- Initial access comes from customized phishing emails, abuse of the Remote Desktop Protocol, and known vulnerabilities.
- Tools named for discovery and access include PowerShell, Metasploit, Mimikatz, BloodHound and Cobalt Strike.
- Lateral movement uses PSExec and RDP, and the Domain Controller network share is used to spread the ransomware.
- For exfiltration, the report names 7-Zip, Rclone, Mega Client and PuTTy.
- Certutil and Bitsadmin were observed downloading the ransomware. After encryption, the desktop background changes and a ransom note is left.
How Can Teams Use the Detection Material?
The MITRE ATT&CK chapter maps behavior to technique IDs such as T1566 Phishing, T1190 Exploit Public-Facing Application, T1059.001 PowerShell, T1490 Inhibit System Recovery and T1486 Data Encrypted for Impact. The last chapter lists encryptor MD5 hashes, domains and IP addresses to scan an environment with. The conclusion advises potential victims not to pay the ransom and to report the incident to the authorities.
Who Is This Report for?
Security analysts, incident responders and threat hunters who need the techniques and indicators. Managers can read the Overview and Conclusion for the business context.
What Does the DarkSide Ransomware Analysis Report Cover?
The report is 24 pages long. It is dated 25 July 2021. Its chapters are Overview, Targeted Countries and Sectors, DarkSide Attack Lifecycle, MITRE ATT&CK, Conclusion and Indicators of Compromise.
What Does the Report Say About the Group?
- The Overview gives a campaign timeline from August 2020 to the Colonial Pipeline attack in May 2021.
- It says Colonial Pipeline paid a $4.4 million ransom and that the FBI confirmed DarkSide was behind the attack.
- It says the group sold its ransomware as a service, so lifecycles can differ from one operation to the next.
- The group does not target healthcare, education, non-profit or government organizations, according to the report.
- It says DarkSide checks system language settings to avoid certain countries, and that its code resembles REvil ransomware.
What Technical Findings Does the Attack Lifecycle Chapter Give?
- Initial access comes from customized phishing emails, abuse of the Remote Desktop Protocol, and known vulnerabilities.
- Tools named for discovery and access include PowerShell, Metasploit, Mimikatz, BloodHound and Cobalt Strike.
- Lateral movement uses PSExec and RDP, and the Domain Controller network share is used to spread the ransomware.
- For exfiltration, the report names 7-Zip, Rclone, Mega Client and PuTTy.
- Certutil and Bitsadmin were observed downloading the ransomware. After encryption, the desktop background changes and a ransom note is left.
How Can Teams Use the Detection Material?
The MITRE ATT&CK chapter maps behavior to technique IDs such as T1566 Phishing, T1190 Exploit Public-Facing Application, T1059.001 PowerShell, T1490 Inhibit System Recovery and T1486 Data Encrypted for Impact. The last chapter lists encryptor MD5 hashes, domains and IP addresses to scan an environment with. The conclusion advises potential victims not to pay the ransom and to report the incident to the authorities.
Who Is This Report for?
Security analysts, incident responders and threat hunters who need the techniques and indicators. Managers can read the Overview and Conclusion for the business context.