Introduction
Darkside, the latest ransomware operation to emerge has been attacking organizations beginning earlier this month. Darkside’s customized attacks on companies have already garnered them million-dollar payouts. Through their “press release”, these threat actors have claimed to be affiliated with prior ransomware operations making millions of dollars. They stated that they created this new product to match their needs, as prior products didn’t. Darkside explains that they only target companies they know that can pay the specified ransom. They have allegedly promised that they will not attack the following sectors. They include medicine, education, non-profit organizations, and the government sector.
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Ransomware Vulnerability Matrix observations
| Category | Vendor | Product | CVEs |
|---|---|---|---|
| Network Edge | Palo Alto Networks | GlobalProtect Portal & Gateway Interface | CVE-2019-1579 |
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
Ransomware Tool Matrix observations
| Category | Observed tools |
|---|---|
| Credential Theft | Mimikatz, SessionGopher |
| Discovery | ADRecon, AdFind, Advanced IP Scanner, SoftPerfect NetScan |
| Exfiltration | Bashupload, MEGA, PrivatLab, RClone, Sendspace, pCloud |
| LOLBAS | PsExec |
| Networking | Plink |
| OffSec | Cobalt Strike, CrackMapExec, Impacket, PowerSploit |
| RMM Tools | AnyDesk, GoToAssist, TightVNC |
Attribution and Evidence
Information pending cataloguing.
References
References pending cataloguing.