Rewterz Threat Alert – DarkSide Ransomware – Active IOCs

Severity

High

Analysis Summary

DarkSide is a ransomware group that emerged in August 2020. It is known for targeting large organizations and demanding large sums of money in exchange for the decryption of encrypted data. They employs various attack techniques to gain unauthorized access to target networks. This includes exploiting vulnerabilities, conducting phishing campaigns, and using stolen or brute-forced credentials. Once inside the network, they escalate privileges and encrypt critical systems and data. The group is known for its double extortion technique, where they not only encrypt the victim’s data but also threaten to disclose the stolen data publicly if the ransom is not paid (typically in the form of cryptocurrency). DarkSide targets large organizations, particularly those in the oil and gas industry, the group has been linked to several high-profile ransomware attacks, including those on Colonial Pipeline and the meat processing company JBS USA. 

DarkSide is known for its professionalism and business-like approach. They have a code of conduct that prohibits targeting certain organizations, such as hospitals, nonprofits, schools, and government agencies. However, this code is not strictly enforced, and collateral damage to these organizations has been reported.

To increase the pressure on victims, DarkSide employs various tactics, such as publicly shaming organizations on their leak site or threatening to publish sensitive data on underground forums. They also maintain a customer service-like approach, providing a helpdesk for victims to negotiate ransom payments and offering technical support to their affiliates.

Impact

• Information Theft
• File encryption
• Unauthorized Access

Indicators of Compromise

MD5

• f00aded4c16c0e8c3b5adfc23d19c609
• 650d18a78f30302a1e10f664a0d2cb0a
• e81f857bffd0269d9375b08354de3293

SHA-256

• 4d9432e8a0ceb64c34b13d550251b8d9478ca784e50105dc0d729490fb861d1a
• 2c7d10f64dc39ea9bd6f18d9d1e1204f0c62324e8da148354d557bba17e3c615
• 6d656f110246990d10fe0b0132704b1323859d4003f2b1d5d03f665c710b8fd3

SHA-1

• 86ca4973a98072c32db97c9433c16d405e4154ac
• c318776aefbd0156de1e6f7bba216d87e27c6341
• 141b4bc53ae0d4ff5d292cd175cd687fd2f57290

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.