DarkSide

Threat Actor updated 2 months ago (2024-10-03T23:01:52.480Z)

Download STIX

Preview STIX

DarkSide is a threat actor known for its malicious activities, primarily in the realm of ransomware attacks. One of their most notable exploits occurred on May 7, 2021, when they targeted Colonial Pipeline Co., a major player in the U.S. energy sector. The attack disrupted the gasoline supply across parts of the United States and resulted in Colonial Pipeline paying a $4.4 million ransom to recover from the DarkSide ransomware attack. In total, the DarkSide ransomware group received $4.6 million in ransom payments in 2021. They are also suspected of being involved in deploying other ransomware types such as REvil. Security researchers have identified DarkSide's involvement in various ransomware-as-a-service (RaaS) projects, including its own DarkSide project and later, BlackMatter, after encountering issues with U.S. law enforcement. The DarkSide and BlackMatter operations were reportedly capable of deploying ransomware against VMWare ESXi and Synology NAS systems, demonstrating a high level of technical sophistication. These groups have also been linked to the Emotet botnet, which has been used to distribute ransomware. However, DarkSide's reign was short-lived. Following the Colonial Pipeline attack, the FBI managed to recover the majority of the ransom within a month. DarkSide subsequently lost control of its infrastructure to U.S. law enforcement, possibly including the U.S. military, before going dark. Despite attempts to rebrand and reemerge as BlackMatter, the group was quickly dismantled by the FBI. It's worth noting that some members of DarkSide and BlackMatter are suspected to have ties to the Alphv/BlackCat and REvil groups, indicating a potential pattern of threat actors evolving and adapting in response to law enforcement actions.

Description last updated: 2024-10-03T22:16:09.844Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Blackmatter is a possible alias for DarkSide. BlackMatter, a threat actor in the cybersecurity realm, is known for its malicious activities and has been linked to several ransomware strains. The group emerged as a successor to the DarkSide ransomware, which was responsible for the high-profile attack on the Colonial Pipeline in May 2021. Howeve	9
Alphv is a possible alias for DarkSide. Alphv, also known as BlackCat, is a notable threat actor in the cybersecurity landscape. Originating from Russia, this cybercriminal group has been involved in multiple high-profile ransomware attacks, specifically targeting healthcare providers. They gained significant attention after stealing 5TB	7

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Ransomware

Ransom

RaaS

Malware

Windows

Esxi

Cybercrime

Vulnerability

Vpn

Bitcoin

Extortion

Russia

Scam

Encryption

Exploit

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The REvil Malware is associated with DarkSide. REvil, also known as Sodinokibi, is a malicious software (malware) that operates on a Ransomware as a Service (RaaS) model. This model became increasingly popular in 2020, with first-stage malware like Dridex and Gootkit being linked to ransomware attacks such as BitPaymer and REvil respectively. Th	is related to	9
The Lockbit Malware is associated with DarkSide. LockBit is a malicious software, or malware, known for its damaging and exploitative functions. It infiltrates systems via dubious downloads, emails, or websites, often without the user's knowledge, and can steal personal information, disrupt operations, or hold data hostage for ransom. The LockBit	Unspecified	6
The Avaddon Malware is associated with DarkSide. Avaddon is a type of malware, specifically ransomware, designed to exploit and damage computer systems. It was notable for its compatibility with older systems such as Windows XP and Windows 2003, distinguishing it from other ransomware like Darkside and Babuk which targeted more modern systems like	Unspecified	5
The Maze Malware is associated with DarkSide. Maze is a form of malicious software, or malware, that pioneered a novel double-extortion tactic in the cyber threat landscape. Its modus operandi involves stealing victims' files before encrypting them, thereby enabling the threat actors to threaten both the disruption of operations and the release	Unspecified	5
The Conti Malware is associated with DarkSide. Conti is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them. Often spreading through suspicious downloads, emails, or websites, it can steal personal information, disrupt operations, or hold data hostage for ransom. Notably, Conti was linked to several ra	Unspecified	4
The Babuk Malware is associated with DarkSide. Babuk is a form of malware, specifically ransomware, that infiltrates computer systems and encrypts files, rendering them inaccessible to the user. It typically infects systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can disrupt operatio	Unspecified	4
The Clop Malware is associated with DarkSide. Clop, a malicious software (malware), is linked to a Russian-speaking cybercriminal group also known as Cl0p. It is designed to exploit and damage computer systems by stealing personal information, disrupting operations, or holding data hostage for ransom. In May 2023, the Clop group began exploitin	Unspecified	3
The Hive Malware is associated with DarkSide. Hive is a form of malware, specifically ransomware, designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, Hive can steal personal information, disrupt operations, or hold data hostag	Unspecified	3
The Ragnar Locker Malware is associated with DarkSide. Ragnar Locker is a type of malware, specifically ransomware, known for its destructive impact on computer systems. It infiltrates systems primarily through suspicious downloads, emails, or websites, and once inside, it can steal personal information, disrupt operations, or hold data hostage for rans	Unspecified	3
The Ryuk Malware is associated with DarkSide. Ryuk is a type of malware known as ransomware, which has been utilized by the threat group ITG23 for several years. This group has been notorious for crypting their malware, with crypters seen in use with other malware such as Trickbot, Emotet, Cobalt Strike, and Ryuk. In 2019, most ransomware inves	Unspecified	3
The Trigona Malware is associated with DarkSide. Trigona was a significant strain of ransomware that emerged in 2022, known for its harmful effects on computer systems. The malware infiltrated systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it could steal personal information, disrupt ope	Unspecified	2
The Maze Ransomware Malware is associated with DarkSide. Maze ransomware is a type of malware that emerged in 2019, employing a double extortion tactic to wreak havoc on its victims. This malicious software infiltrates systems through suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for	Unspecified	2
The Cheerscrypt Malware is associated with DarkSide. Cheerscrypt is a malicious software (malware) that was discovered in May 2022, specifically designed to target ESXi servers, which are extensively used by enterprises for server virtualization. This discovery was made following the reporting of DarkSide ransomware variants in May 2021. Cheerscrypt,	Unspecified	2
The Lockbit Black Malware is associated with DarkSide. LockBit Black, also known as LockBit 3.0, is a malicious software that emerged in early 2022 following the release of its predecessor, LockBit 2.0 (or LockBit Red) in mid-2021. The malware has been developed to exploit and damage computer systems by encrypting files, often leading to ransom demands	Unspecified	2
The Bablock Malware is associated with DarkSide. BabLock, also known as Rorschach, is a type of malware that operates as ransomware. First identified by Check Point Research in April 2023, this harmful software infiltrates computer systems and devices, often without the user's knowledge, with the aim to exploit, damage, and potentially hold data h	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The FIN7 Threat Actor is associated with DarkSide. FIN7, also known as Carbanak, Carbon Spider, Cobalt Group, and Navigator Group, is a notorious cybercrime group that has been active since 2012. The group is recognized for its advanced combination of malware and social engineering tactics, having executed numerous successful attacks against global	Unspecified	4
The Sodinokibi Threat Actor is associated with DarkSide. Sodinokibi, also known as REvil, is a highly active and impactful threat actor first identified in April 2019. Operating as a ransomware-as-a-service (RaaS), this group has been responsible for a significant proportion of global ransomware incidents. In 2020, Sodinokibi ransomware attacks accounted	Unspecified	3
The LockBitSupp Threat Actor is associated with DarkSide. LockBitSupp, a prominent threat actor, has been identified as Russian national Dmitry Yuryevich Khoroshev. The group's activities have been under scrutiny due to its involvement in ransomware attacks and other cybercrimes. Khoroshev, who was operating under the aliases "LockBit" and "LockBitSupp," i	Unspecified	2
The Sangria Tempest Threat Actor is associated with DarkSide. Sangria Tempest, also known as Carbon Spider, Elbrus, and FIN7, is a threat actor that has been active since 2013. In mid-November 2023, Microsoft observed Sangria Tempest using Storm-1113's EugenLoader delivered through malicious MSIX package installations. The group frequently targets the restaura	Unspecified	2

Associated Vulnerabilities

To see the evidence that has resulted in these vulnerability associations, create a free account

Alias Description	Association Type	Votes
The vulnerability CVE-2021-20016 is associated with DarkSide.	Unspecified	2

Source Document References

Information about the DarkSide Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
BankInfoSecurity	2 months ago	Breach Roundup: AI 'Nudify' Sites Serve Malware
Securityaffairs	3 months ago	A cyberattack hit US oil giant Halliburton
BankInfoSecurity	3 months ago	Oil Services Giant Halliburton Disrupted by Hack Attack
DARKReading	4 months ago	Security End-Run: 'AuKill' Shuts Down Windows-Reliant EDR Processes
BankInfoSecurity	5 months ago	Millions Affected by Prudential Ransomware Hack in February
Quick Heal Technologies Ltd.	5 months ago	Doubt Your Vulnerability to Ransomware Attacks? Know How Quick Heal’s Protection Will Save You!
BankInfoSecurity	7 months ago	FIN7 Targeted US Automotive Giant In Failed Attack
CERT-EU	8 months ago	Protecting branch office environments from ransomware
CERT-EU	8 months ago	Ransomware's appetite for US healthcare sees known attacks double in a year \| Malwarebytes
CERT-EU	8 months ago	Ransomware Talent Surges to Akira After LockBit's Demise
BankInfoSecurity	8 months ago	Ransomware Talent Surges to Akira After LockBit's Demise
CERT-EU	8 months ago	The Change Healthcare attack: Explaining how it happened \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	8 months ago	Operational Technology Threats - ReliaQuest
CERT-EU	8 months ago	The Great BlackCat Ransomware Heist
CERT-EU	8 months ago	Cybersecurity tips to follow to keep your information safe \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	9 months ago	ALPHV/BlackCat gang vanishes amid ransomware ‘turmoil‘ \| #ransomware \| #cybercrime \| National Cyber Security Consulting
CERT-EU	9 months ago	Ransomware group behind Change Healthcare attack goes dark
CERT-EU	9 months ago	Calls grow for federal funding after Change Healthcare cyberattack
CERT-EU	9 months ago	Blackcat ransomware site reportedly seized but UK agency denies responsibility \| #ransomware \| #cybercrime \| National Cyber Security Consulting
InfoSecurity-magazine	9 months ago	ALPHV/BlackCat Ransomware Servers Go Down