What Is DarkSide Ransomware And The Sinister Group Behind It

The DarkSide ransomware group further made their voice heard by attacking businesses like Toshiba Tec Corp. and Brenntag. But the straw that broke the camel’s back came in May 2021 when they attacked the Colonial Pipeline Company, who operates the Colonial Pipeline which supplies 45% of the US east coast’s fuel. This forced the company to shut down their digital systems for five whole days, which attracted the attention of the FBI. Investigators managed to seize $2.3 million worth of cryptocurrency from the DarkSide ransomware group, who appeared to disband in response.

But cybersecurity experts argue that their dissolution may be a ruse—meaning you and your company may still be at risk when it comes to DarkSide ransomware. Read on to discover more about this harmful ransomware, and learn how you and your company can stay protected from it.

What Does DarkSide ransomware Do?

DarkSide ransomware encrypts and steals sensitive data, typically from large companies with the means to pay the requested ransom. The attackers then threaten to make the stolen data publicly available in the event their stated ransom is not paid in full.

What Makes DarkSide Such A Threat?

But what makes the DarkSide ransomware group such a threat is that they employ a double extortion approach to extract money from DarkSide ransomware victims. Namely, DarkSide ransomware demands one payment to unlock affected devices, and then another payment to retrieve stolen data.

How Does DarkSide Spread?

In order to gain access to a company’s network of devices, the group employed techniques such as phishing, remote desktop protocol (RDP) abuse, and brute force attacks, all in an attempt to exploit the CVE-2020-3992 and CVE-2019-5544 vulnerabilities—both of which have since been patched to fix the vulnerabilities.

Once in, the ransomware checks the infected machine’s default system language and its name. If the infected user has administrative privileges to their devices, it’s down to business; if not, the ransomware is happy to try obtaining privileges with a user account control bypass technique. Next, the ransomware exfiltrates data and encrypts local data on the machine. Finally, it disables security protection services and deletes volume shadow copies. This way, the user can’t revert their encrypted data back to the non-encrypted copies.

With the files encrypted and data exfiltrated, the attackers plant a ransom note instructing the DarkSide ransomware victims that their data will be made publicly available—and the media informed—if the ransom is not paid in full before the specified time.

Help Me Protect My Web Assets From The Dark Side!

We can do that—and you don’t even need to have the Force to pull it off! Here’s a handful of smart, intuitive ways to protect yourself from the DarkSide ransomware group:

• Secure your accounts with strong, unique passwords that aren’t easy to guess

• Update your device software regularly with the latest updates and protections

• Disallow admin privileges to users unless absolutely necessary

• Back up your data to a source that isn’t connected to a network

• Disable RDP when not being used, or switch the RDP port to something non-standard if necessary

• Watch for privileges being granted and software being removed without permission

• Keep track of all outbound network traffic which could indicate your data is being stolen

By adhering to each and every one of these helpful tips, you can help ensure that DarkSide ransomware remains a thing of the past.

Shine Bright With SiteLock

Now that you know all there is to know about staying protected from DarkSide ransomware, you’re ready to defend yourself and your organization against cybercriminals. Read “What Is Ransomware?” to learn how hackers hold sites hostage—and which four steps can ensure yours will be protected.