Severity
High
Analysis Summary
The Darkside ransomware group announced their RaaS (Ransomware-as-a-Service) in August of 2020 via a “press release. DarkSide states that they only target companies that can pay the specified ransom giving the impression as they do not “want to kill businesses” in other words Darkside ransomware first conduct thorough study of organization they’re targeting to check whether the victims organization is able to fulfill their demand or not,
Threat actors have been targeting Government sector, education, health, non profit organizations, with ransom demands range from $200,000 to $2,000,000. These numbers can likely be more or less depending on the victim.
DarkSide will first steal your data and then encrypt your files and like other human-operated ransomware attacks, when the DarkSide operators breach a network, they will spread laterally throughout a network until they gain access to an administrator account and the Windows domain controller.While they spread laterally, the attackers will harvest unencrypted data from the victim’s servers and upload it to their own devices.
Furthermore, DarkSide will post the data leak site under their control and used as part of the extortion attempt in order to scare the victim of the into paying the ransom even if they can recover from backups.
Impact
- Data theft
- File encryption
Indicators of Compromise
Domain Name
- koliz[.]xyz
- w2doger[.]xyz
IP
- 185[.]231[.]68[.]102
- 185[.]92[.]151[.]150
- 81[.]91[.]177[.]54
MD5
- a9fa3eba3f644ba352462b904dfbcc1a
SHA-256
- 2eb1a2a367b951cd0c6c53fa802a1444c03ff534d06ebac2f961bb219545215a
SHA-1
- 919509c6f95ea271ae9663a249e98361f9038350
URL
- http[:]//sdoc[.]xyz/ID-508260156241
Remediation
- Block the threat indicators at their respective controls.
- Search for IOCs in your environment.
- Do not download software and files from unofficial and untrusted sources.
- Organizations can strengthen their defenses against ransomware by updating their systems and applications to the latest versions and using multi-factor authentication.
- Increase awareness of how ransomware spreads, i.e., through spammed emails and attachments.
- Monitor and audit network traffic for any suspicious behaviors or anomalies.