Darkrace

DarkRace, a variant of malware known as ransomware, first appeared in mid-2023 and was identified as a significant threat by cybersecurity firm Cyble. The malware employs a strategy of double extortion, not only encrypting the victim's files and demanding a ransom for their decryption, but also threatening to leak stolen files if the ransom is not paid. DarkRace reportedly used source code from LockBit, another ransomware group, which was leaked in September 2022. Despite its initial activity, DarkRace's data leak site had gone dark by mid-2023 after listing only two victims. In May 2023, the malware underwent a rebranding, continuing its operations under the name DarkRace. Notably, it shares a similar configuration file and ransom note with another ransomware called DoNex, which emerged in March 2024. This similarity suggests that DoNex may be based on DarkRace and that the same threat actor could potentially be behind both. However, the exact relationship between the developer or operators of Muse, DarkRace, and DoNex remains unclear. DoNex is recognized as a rebrand of both Muse and DarkRace ransomware, with its first appearance in the threat landscape dating back to April 2022. An intern at SANS Institute, John Moutos, noted in an April blog post that a group called DoNex had entered the fray using samples that closely resembled those previously used by the DarkRace group, and by extension, LockBit. Given these developments, it's crucial for organizations to remain vigilant against these evolving cyber threats.