Darkside
Darkside ransomware group has started its operation in August of 2020 with the model of RaaS (Ransomware-as-a-Service). They have become known for their operations of large ransoms scale. They have announced that they prefer not to attack hospitals, schools, non-profits, and governments, but rather big organizations that can be able to pay large ransoms. Darkside ransomware group became very famous following the cyberattack of the Colonial Pipeline and Toshiba unit. The FBI finally terminate the Darkside operation and Managed to pull money from their wallets back.
Threat level
LOW
Get an alert if one of your domains is named on a ransomware leak site.
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
- SessionGopher
DiscoveryEnum
- ADRecon
- AdFind
- Advanced IP Scanner
- SoftPerfect NetScan
Exfiltration
- Bashupload
- MEGA
- RClone
- Sendspace
- pCloud
LOLBAS
- PsExec
Networking
- Plink
Offsec
- Cobalt Strike
- CrackMapExec
- Impacket
- PowerSploit
RMM-Tools
- AnyDesk
- GoToAssist
- TightVNC
Known infrastructure
The following Tor hidden services have been associated with this group:
darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Darkside’s victim list.
risk score · threat categories · sources · age · confidence — in one request