Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Dark Side Ransomware Gang: An Overview

Summary: DarkSide became one of the world's most well-known hacking groups after the FBI confirmed it was responsible for the highly publicized attack on a major U.S. pipeline company that raised the possibility of disrupting gasoline and jet fuel supplies on the Eastern Seaboard. Unit 42, which first encountered the group around a year before the report and began finding its fingerprints in cases from October 2020, describes DarkSide as operating at the high end of the ransomware ecosystem under a Ransomware-as-a-Service model, with discipline traditionally seen only from nation-state actors and likely operating as a criminal network out of Russia.

What's compelling: DarkSide pressures victims on a clock: if they don't respond within two or three days, it emails employees, then calls senior executives on mobile phones, then threatens customers and the press, then may launch DDoS - and its early-2021 ESXi ransomware let it encrypt VMware virtual infrastructure even where endpoint security protected Windows PCs, taking down file shares, DNS and email.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related