Rewterz Threat Alert – Darkside Ransomware – Active IOCs

Severity

High

Analysis Summary

The Darkside ransomware group announced their RaaS (Ransomware-as-a-Service) in August of 2020 via a “press release. DarkSide states that they only target companies that can pay the specified ransom giving the impression as they do not “want to kill businesses” in other words Darkside ransomware first conduct thorough study of organization they’re targeting to check whether the victims organization is able to fulfill their demand or not,

Threat actors have been targeting Government sector, education, health, non profit organizations, with ransom demands range from $200,000 to $2,000,000. These numbers can likely be more or less depending on the victim.

DarkSide will first steal your data and then encrypt your files and like other human-operated ransomware attacks, when the DarkSide operators breach a network, they will spread laterally throughout a network until they gain access to an administrator account and the Windows domain controller.While they spread laterally, the attackers will harvest unencrypted data from the victim’s servers and upload it to their own devices. 
Furthermore, DarkSide will post the data leak site under their control and used as part of the extortion attempt in order to scare the victim of the into paying the ransom even if they can recover from backups.

Impact

• Data theft
• File encryption

Indicators of Compromise

Domain Name

• koliz[.]xyz
• w2doger[.]xyz

IP

• 185[.]231[.]68[.]102
• 185[.]92[.]151[.]150
• 81[.]91[.]177[.]54

MD5

• a9fa3eba3f644ba352462b904dfbcc1a

SHA-256

• 2eb1a2a367b951cd0c6c53fa802a1444c03ff534d06ebac2f961bb219545215a

SHA-1

• 919509c6f95ea271ae9663a249e98361f9038350

URL

• http[:]//sdoc[.]xyz/ID-508260156241

Remediation

• Block the threat indicators at their respective controls.
• Search for IOCs in your environment.
• Do not download software and files from unofficial and untrusted sources.
• Organizations can strengthen their defenses against ransomware by updating their systems and applications to the latest versions and using multi-factor authentication.
• Increase awareness of how ransomware spreads, i.e., through spammed emails and attachments.
• Monitor and audit network traffic for any suspicious behaviors or anomalies.