Dark Side Ransomware | Qualys
Summary: DarkSide ransomware, first seen in August 2020 and updated to v2.0 in March 2021, targets large, high-revenue organizations to encrypt and steal sensitive data, operating as ransomware-as-a-service with double extortion. It gains initial access through brute-force attacks and exploitation of RDP and the patched VMware ESXi vulnerabilities CVE-2019-5540 and CVE-2020-3992, then escalates privileges via a UAC bypass using the CMSTPLUA COM interface, deletes volume shadow copies through PowerShell, disables security services, and encrypts files with Salsa20 and an RSA-1024 public key.
What you should know: The two VMware ESXi vulnerabilities DarkSide exploits already have widely available patches, yet attackers keep succeeding against organizations running unpatched or older software - and the group reportedly shut down only after the six-day Colonial Pipeline outage, not because defenders stopped it.
Read the original at Qualys Blog ↗
- Topics
- Ransomware
- Mentions
- CVE-2019-5544CVE-2020-3992
- Related
- Grey Noise | Exploit Vector Analysis of Emerging ‘ESXiArgs’ Ransomware (a.k.a. Wow do I hate ESXi Threat Intel [right now]) Cyber Risks ·CVE-2020-3992: VMware ESXi OpenSLP Use-After-Free Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2019-5544: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021