Rewterz Threat Alert – DarkSide Ransomware – Active IOCs

Severity

High

Analysis Summary

Researchers recently observed the emergence of a new ransomware operation named DarkSide threat actor, once again thrusting the group’s name into the spotlight. Threat actors are taking advantage of social engineering campaigns. DarkSide Campaign is targeting the food and energy industry by sending threatening emails. In the emails, the threat actor declares that they have successfully exploited networks and gained unauthorized access to sensitive information, which will be disclosed publicly if a ransom of 100 bitcoins (BTC) is not paid. This campaign is started on June 4 and hitting a few targets every day.

Impact

• Information Theft
• File encryption
• Unauthorized Access

Indicators of Compromise

MD5

• b278d7ec3681df16a541cf9e34d3b70a

SHA-256

• bafa2efff234303166d663f967037dae43701e7d63d914efc8c894b3e5be9408

SHA-1

• 666a451867ce40c1bd9442271ef3be424e2d9b17

Remediation

• Block all threat indicators at your respective controls
• Search for IOCs in your environment.