Skip to main content
DarkSide Ransomware

First seen in early August, DarkSide is a human-operated targeting English-speaking countries. The group behind it will also harvest data during infection in an attempt to extort victims into meeting their substantial ransom demands.

Report a cyber attack: call 0300 303 5222 or email carecert@nhsdigital.nhs.uk

Summary

First seen in early August, DarkSide is a human-operated targeting English-speaking countries. The group behind it will also harvest data during infection in an attempt to extort victims into meeting their substantial ransom demands.


Affected platforms

The following platforms are known to be affected:

Threat details

Introduction

DarkSide is a newly observed human-operated ransomware tool targeting organisations in English-speaking countries.

The group behind DarkSide appear to be highly professional, producing a number of PR briefs as well as a mission statement outlining their goals. They claim they will only target organisations that are able to comfortably pay their ransom demands, which range from $200,000 to $2,000,000.

There are also a number of similarities between DarkSide and the older GandCrab and Sodinokibi ransomware-as-a-service tools, raising the possibility that it is a continuation or successor to these malware.


Delivery

The group operating DarkSide will perform extensive reconnaissance on a target network before attempting to gain initial access. If successful, they will then traverse the network, with the aim of gaining access to a connected Windows domain controller and its associated administrative account. During this traversal, the group will extract unencrypted data from any servers they access.

Although it has not been confirmed at the time of publication, it is assumed that the group uses the compromised domain controller to distribute DarkSide to any client that connects to it.


Activities

Once delivered to a target system, DarkSide will check the default user or system languages and terminates itself if it determines it is running on a system located in a CIS country.

DarkSide then uses a heavily obfuscated PowerShell script to delete any existing Shadow Volume Copies to prevent file recovery, before terminating a number of database, office, and mail applications.

Files are encrypted using a bespoke Salsa20 implementation, the keys for which are then encrypted using RSA-1024. A custom extension created using a checksum of the target system's MAC address is then appended to each file.

If successful, a ransom note is then manually posted on the target system detailing the type and amount of data extracted by the group along with a direct link to their leak site. This site contains further details on the extracted data, along with a statement from the group that any affected organisation that refuses to pay their ransom will have their data exposed for a minimum of six months.


Threat updates

Date Update
19 May 2021 New capabilities discovered in DarkSide variant

Previously unseen capabilities have been discovered in a variant of DarkSide ransomware, extending its potential impact on a compromised system. This variant can find partition information and use this to compromise multiple disk partitions on a multiboot system, enabling it to encrypt additional files. It can also perform an Active Directory attack by seeking out domain controllers and using them to connect to the Active Directory via LDAP to authenticate anonymously. The malware then attempts to delete variables such as defaultNamingContext and dnsHostName.

13 May 2021 Adaptations to Ransomware-as-a-Service

DarkSide operators have reiterated their intention to exempt certain organisations from attacks involving their ransomware, including hospitals and other public sector entities. DarkSide operators carry out ransomware campaigns in partnership with affiliated threat groups, with the affiliate groups being subjected to a vetting process to ensure they adhere to these constraints.

Operators provide affiliates with access to an administrative panel via Tor to customise attacks and subsequent extortion activities. Distributed Denial-of-Service (DDoS) is also now an option for extortion campaigns involving DarkSide ransomware.

21 Jan 2021 Free decryptor available

Bitdefender has released a free recovery tool to recover files encrypted by DarkSide.

Organisations should be aware that NHS Digital have not tested and do not endorse this tool, and they use it at their own risk.

26 Nov 2020 Leak site creation

DarkSide's operators are creating a leak site and distributed storage system based in Iran, It is believed the system will be used to circumvent attempts by competing RaaS operators or law enforcement bodies to interrupt DarkSide's operations.


Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

  • Critical data is frequently saved in multiple backup locations.
  • At least one backup is kept offline at any time (separated from live systems).
  • Backups and incident recovery plans are tested to ensure that data can be restored when needed.
  • User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
  • Infected systems are disconnected from the network and powered down as soon as practicable.
  • Any user account credentials that may have been compromised should be reset on a clean device
  • Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.


Indicators of compromise

Host indicators

PowerShell commands

  • Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}

File hashes (SHA256)

  • 9cee5522a7ca2bfca7cd3d9daba23e9a30deb6205f56c12045839075f7627297

File hashes (MD5)

  • 04fde4340cc79cd9e61340d4c1e8ddfb
  • 0e178c4808213ce50c2540468ce409d3
  • 0ed51a595631e9b4d60896ab5573332f
  • 130220f4457b9795094a21482d5f104b
  • 1a700f845849e573ab3148daef1a3b0b
  • 1c33dc87c6fdb80725d732a5323341f9
  • 222792d2e75782516d653d5cccfcf33b
  • 29bcd459f5ddeeefad26fc098304e786
  • 3fd9b0117a0e79191859630148dcdc6d
  • 47a4420ad26f60bb6bba5645326fa963
  • 4c99af42d102c863bbae84db9f133a82
  • 4d419dc50e3e4824c096f298e0fa885a
  • 5ff75d33080bb97a8e6b54875c221777
  • 66ddb290df3d510a6001365c3a694de2
  • 68ada5f6aa8e3c3969061e905ceb204c
  • 69ec3d1368adbe75f3766fc88bc64afc
  • 6a7fdab1c7f6c5a5482749be5c4bf1a4
  • 84c1567969b86089cc33dccf41562bcd
  • 885fc8fb590b899c1db7b42fe83dddc3
  • 91e2807955c5004f13006ff795cb803c
  • 9d418ecc0f3bf45029263b0944236884
  • 9e779da82d86bcd4cc43ab29f929f73f
  • a3d964aaf642d626474f02ba3ae4f49b
  • b0fd45162c2219e14bdccab76f33946e
  • b278d7ec3681df16a541cf9e34d3b70a
  • b9d04060842f71d1a8f3444316dc1843
  • c2764be55336f83a59aa0f63a0b36732
  • c4f1a1b73e4af0fbb63af8ee89a5a7fe
  • c81dae5c67fb72a2c2f24b178aea50b7
  • c830512579b0e08f40bc1791fc10c582
  • cfcfb68901ffe513e9f0d76b17d02f96
  • d6634959e4f9b42dfc02b270324fa6d9
  • e44450150e8683a0addd5c686cd4d202
  • f75ba194742c978239da2892061ba1b4
  • f87a2e1c3d148a67eaeb696b1ab69133
  • f913d43ba0a9f921b1376b26cd30fa34
  • f9fc1a1a95d5723c140c2a8effc93722

Network indicators

IP addresses

  • 185[.]180[.]197[.]86

Last edited: 19 May 2021 3:11 pm