DarkSide is a relatively new ransomware group, which first appeared in August 2020 on one of the Russian language hacking forums where they were availing their ransomware to others groups. They are a new type of ransomware-as-a-service business, attempting to instill trust and reliability between themselves and their victims. The stealthy techniques followed by the threat actors ensure the attack tools and pattern would evade detection on the monitored system.

The DarkSide group aggressively pressure the victims to pay the ransom amount. In short, they don’t like to be ignored. In case the victims do not reply within two or three days, they start to send threatening emails to employees. Even if that doesn’t work, they start calling senior executives on their mobile phones. The next course of action is to threaten the victim by saying that they would start to contact the victim’s customers or the press. And if that doesn’t work, they might launch DDoS to take down the whole external websites.

DarkSide group techniques build on the typical pattern of a ransomware attack, which includes encrypting the files and demanding a ransom amount to decrypt them and restore access. It is obvious that some of the victims have already backed up their data, and they do not see a need to pay the ransom amount to get the decryption keys for restoration purposes. Darkside group is already prepared for that scenario and exfiltrate sensitive information and analyze the victim’s network so that they can up the amount if a victim refuses to pay it. Following that, they threaten to release the data publicly or launch a DDoS attack.

DarkSide group also offers its RaaS to third parties for a percentage of the profits. They operate with a more advanced business model and identifies high-value targets, involving more precise monetization of the compromised assets. These attacks can be typically run by more than one group that collaborates and split profits. Following the above pointers, these look more like an APT (advanced persistent threat) attack than a traditional ransomware event.

Based on the publicly available reports, here is a detailed timeline of DarkSide activity:

• August 2020: DarkSide ransomware was introduced.
• October 2020: DarkSide donates US$20,000 stolen from victims to various charities.
• November 2020: DarkSide establishes its RaaS business model. A data leak site is later discovered.
• November 2020: They launch their own content delivery network (CDN) for storing and delivering compromised data.
• December 2020: Media outlets and data recovery organizations are invited to follow the group’s press center on the public leak site.
• March 2021: The version 2.0 of its ransomware gets released.
• May 2021: DarkSide launches the Colonial Pipeline attack and announces it as apolitical.

Attack Lifecycle

Based on various incidents observed, the threat actor used various publicly available and legitimate tools that are commonly utilized to ease various stages of the attack lifecycle in a post-exploitation ransomware attack. More details on the group are listed in the figure below.

Image source: https://www.fireeye.com/content/dam/fireeye-www/blog/images/darkside/fig3b.png

Figure 1: Observed TTPs for Darkside Ransomware

Initial access

The various analyzed samples of DarkSide ransomware show that phishing, remote desktop protocol (RDP) abuse, and exploiting known vulnerabilities are the commonly used tactics by the group to gain initial access. DarkSide group also uses legitimate tools throughout the attack chain to remain obfuscate its attack and to remain undetected.

Below is the comprehensive list of legitimate tools used by the group throughout the reconnaissance and gaining-entry phases of the attack:

• PowerShell: for reconnaissance and persistence
• Metasploit Framework: for reconnaissance
• Mimikatz: for reconnaissance
• BloodHound: for reconnaissance
• Cobalt Strike: for installation

For a modern ransomware attack like the DarkSide, gaining initial access no longer immediately leads to ransomware being dropped onto the victim’s machine. There are now several steps that follow in between that are often manually executed by the threat actor.

Lateral movement and privilege escalation

Lateral movement is one of the key discovery phases in any modern ransomware process. The end goal is to identify all the critical data within the victim’s network, which includes the target files and locations to facilitate the upcoming exfiltration and encryption steps.

In the case of DarkSide, the goal of lateral movement activity is to gain Domain Controller (DC) or Active Directory access, which will be further used to steal credentials, escalate privileges, and acquire other valuable assets for data exfiltration. The group laterally moves through the systems, eventually using the DC network share to deploy the ransomware to connected machines. As per the observation, the DarkSide group deployed PSExec and RDP.

Exfiltration

The critical files are exfiltrated before the ransomware is being launched. This is the riskiest step in the DarkSide ransomware execution process, as data exfiltration is more likely to be noticed by the victim organization’s cybersecurity team. It is the last step before any ransomware is dropped, and the attack often speeds up at this point to complete the process before it is detected and stopped.

For exfiltration, these were the tools being used:

• 7-Zip: a utility used for archiving files to prepare for exfiltration of critical data
• Rclone and Mega client: tools used for exfiltrating files to the cloud storage
• PuTTy: an alternative application used for network file transfer

DarkSide uses several Tor-based leak sites to host victim’s stolen data. The file-sharing services used by the DarkSide group for data exfiltration include Mega and PrivatLab.

Execution and impact

The execution of the actual ransomware follows next. It is to be noted that the DarkSide ransomware shares many similarities with REvil in this step of the process, which includes the structure of ransom notes and the use of PowerShell to execute a command which eventually deletes shadow copies from the network. On code analysis, it was found that the same code checks were used by this ransomware to check whether the victim is located in a commonwealth of Independent States (CIS) country or not.

The PowerShell is used to install and operate the malware itself, while Certutil and Bitsadmin were used to download the ransomware. Two encryption methods were used, depending on whether the target operating system is Windows or Linux: A ChaCha20 stream cipher with RSA-4096 is used on Linux, whereas Salsa20 with RSA-1024 is used on Windows.

Below is a sample ransom note from the DarkSide group.

Source: https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/e/what-we-know-about-darkside-ransomware-and-the-us-pipeline-attack/fig1-darksideransomware.jpg

Figure 2. Darkside Ransom Note

It is to be noted that DarkSide’s ransom note is similar to that of Babuk, which drives an indication that these two families share a link between them.

Conclusion

It is to be noted that the ransomware groups are becoming increasingly professionalized, outsourcing code development, infrastructure and C2 operations, as well as operating RaaS business models. Many of them are organized enough to respond to media inquiries and operate victim hotlines.

As these threat actors continue to evolve, the organizations are required to follow the security best practices to safeguard their critical business data and protect against groups such as the DarkSide ransomware gang. It is recommended to have an incident response plan kept in place in case of any such attacks.

References:

• https://unit42.paloaltonetworks.com/darkside-ransomware/
• https://github.com/pan-unit42/iocs/blob/master/Darkside/Darkside_IOCs.txt
• https://www.trendmicro.com/en_us/research/21/e/what-we-know-about-darksideransomware-and-the-us-pipeline-attac.html
• https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darksideransomware-operations.html
• https://us-cert.cisa.gov/ncas/alerts/aa21-131a