Darkrace

DarkRace, a malicious software (malware), emerged in mid-2023 as a ransomware variant using tactics similar to the LockBit lineage. This was after the LockBit source code was leaked by a developer from the ransomware group in September 2022. DarkRace employed a double extortion method, holding stolen files for ransom while also demanding a ransom for a decryption tool. The malware specifically targeted data sources storing administrative files like PDFs and document scans, which often contained sensitive personal and financial information. This intensified the pressure on victims, as reported by cybersecurity firm Cyble in June 2023. In May 2023, the malware underwent rebranding and adopted the name DarkRace. It was observed that DarkRace used a very similar ransom note and had the same configuration file as its predecessor, indicating a possible link between the two. However, it remains unclear whether the same developers or operators were behind both variants. By February 2024, DarkRace may have been rebranded again under the name DoNex, according to findings reported by the SANS Institute. DoNex first appeared in the threat landscape in April 2022, and it closely resembled samples previously used by the DarkRace group, suggesting a potential connection. Despite these developments, by early 2024, DarkRace's data leak site had gone dark, listing only two victims. The continuous evolution and rebranding of this malware strain underline the persistent and evolving threat posed by ransomware to data security.