Rewterz Threat Alert – DarkSide Ransomware – Active IOCs

Severity

High

Analysis Summary

DarkSide is a ransomware group that emerged in August 2020. It is known for targeting large organizations and demanding large sums of money in exchange for the decryption of encrypted data. They employs various attack techniques to gain unauthorized access to target networks. This includes exploiting vulnerabilities, conducting phishing campaigns, and using stolen or brute-forced credentials. Once inside the network, they escalate privileges and encrypt critical systems and data. The group is known for its double extortion technique, where they not only encrypt the victim’s data but also threaten to disclose the stolen data publicly if the ransom is not paid (typically in the form of cryptocurrency). DarkSide targets large organizations, particularly those in the oil and gas industry, the group has been linked to several high-profile ransomware attacks, including those on Colonial Pipeline and the meat processing company JBS USA. 

Impact

• Information Theft
• File encryption
• Unauthorized Access

Indicators of Compromise

MD5

• 3f2cb535fc5bc296aa5b0d2897c265d0
• f587adbd83ff3f4d2985453cd45c7ab1
• 9ce48df9c85282c6d5357c122dff260e
• e294bf7d81c16a2c5f8f21a778e2233b

SHA-256

• f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
• 156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673
• 08b83d16003cba30a98c8faccaebdf8a0521898f55834e44a6e223ffd9237740
• 372aa2920e56781bbed9023b7c462520cd2f230421003934cab58522ba7aaa87

SHA-1

• c30358563fa940eb5cd6064d4d16defee43b0310
• 2715340f82426f840cf7e460f53a36fc3aad52aa
• ed3cbc7e57d36c580d9bb625bc36f28b6197ec43
• d3ce1f7d056fe21ac5b268008d1d814caa08620b

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets