• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – RecordBreaker Malware – Active IOCs
January 18, 2023
Rewterz Threat Alert – STOP (DJVU) Ransomware – Active IOCs
January 19, 2023

Rewterz Threat Alert – DarkSide Ransomware – Active IOCs

January 18, 2023

Severity

High

Analysis Summary

DarkSide is a ransomware group that emerged in August 2020. It is known for targeting large organizations and demanding large sums of money in exchange for the decryption of encrypted data. The group uses a double extortion technique, where they not only encrypt the victim’s data but also threaten to disclose the stolen data publicly if the ransom is not paid (typically in the form of cryptocurrency). DarkSide targets large organizations, particularly those in the oil and gas industry, the group has been linked to several high-profile ransomware attacks, including those on Colonial Pipeline and the meat processing company JBS USA. 

Impact

  • Information Theft 
  • File encryption 
  • Unauthorized Access

Indicators of Compromise

MD5

  • c9f445ba47d43aba67caf6020c2390d3
  • 34d5e3b2e5a29d4eab3a93b3bd27038e
  • 831c6bfffa7515c76c9227fcafbb5b53
  • f7c2b6f1264ae863cbf21db819051437
  • 6bc417da871ff290315237d18ae76664

SHA-256

  • acc70eb94782931ab5f817a91b3c4cedf4c3077fb497a63e90a55e500da7676e
  • 4d59d088de40abcfd78f88d45009dbfdd14d9df76b718bc1c27241ec2807ef8d
  • c78a086f3cd67ac6d8de1ca706fe146d44fa3c46505ff95c7563c7d7d1948b33
  • 7f4b450947cbe4007402816a42e6281cd1f3d76ce090c547d5643d5b8f227d49
  • f0a1bb27f377fc0790acfc272e259d765c1220967b87b784e0e5141cbcaf950b

SHA-1

  • 03180d69fa4b26edbe627e2691df38882eab03b0
  • abc81a9f13f2d1272ff43b7e706de66c22a812f8
  • f74203c542c6e8e7ae81583528f48f6d1b043590
  • c6599df4d126fe8ab6e338dbedddfb063be56f51
  • eebb40025f1ba30d6065bd2a37038af1422b66d2

Remediation

  • Block all threat indicators at your respective controls.
  • Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
  • Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
  • Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
  • Emails from unknown senders should always be treated with caution.
  • Never trust or open ” links and attachments received from unknown sources/senders.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.