Rewterz Threat Alert – DarkSide: New targeted ransomware attacking organizations

Severity

High

Analysis Summary

A new ransomware operation named DarkSide began attacking organizations earlier this month with customized attacks that have already earned them million-dollar payouts. DarkSide states that they only target companies that can pay the specified ransom as they do not “want to kill your business.”

Threat actors have been targeting Government sector, education, health, non profit organizations, with ransom demands range from $200,000 to $2,000,000. These numbers can likely be more or less depending on the victim.

DarkSide will first steal your data and then encrypt your files and like other human-operated ransomware attacks, when the DarkSide operators breach a network, they will spread laterally throughout a network until they gain access to an administrator account and the Windows domain controller.While they spread laterally, the attackers will harvest unencrypted data from the victim’s servers and upload it to their own devices.

Furthermore, DarkSide will post the data leak site under their control and used as part of the extortion attempt in order to scare the victim of the into paying the ransom even if they can recover from backups.

Impact

• Data theft
• File encryption

Remediation

• Organizations can strengthen their defenses against ransomware by updating their systems and applications to the latest versions and using multi-factor authentication.
• Increase awareness of how ransomware spreads, i.e., through spammed emails and attachments.
• Monitor and audit network traffic for any suspicious behaviors or anomalies.