DarkSide is a ransomware group that emerged in August 2020. It is known for targeting large organizations and demanding large sums of money in exchange for the decryption of encrypted data. They employs various attack techniques to gain unauthorized access to target networks. This includes exploiting vulnerabilities, conducting phishing campaigns, and using stolen or brute-forced credentials. Once inside the network, they escalate privileges and encrypt critical systems and data. The group is known for its double extortion technique, where they not only encrypt the victim’s data but also threaten to disclose the stolen data publicly if the ransom is not paid (typically in the form of cryptocurrency). DarkSide targets large organizations, particularly those in the oil and gas industry, the group has been linked to several high-profile ransomware attacks, including those on Colonial Pipeline and the meat processing company JBS USA.
DarkSide is known for its professionalism and business-like approach. They have a code of conduct that prohibits targeting certain organizations, such as hospitals, nonprofits, schools, and government agencies. However, this code is not strictly enforced, and collateral damage to these organizations has been reported.
To increase the pressure on victims, DarkSide employs various tactics, such as publicly shaming organizations on their leak site or threatening to publish sensitive data on underground forums. They also maintain a customer service-like approach, providing a helpdesk for victims to negotiate ransom payments and offering technical support to their affiliates.