Ransomware and Darkside | A detailed checkout | Ransomware prevention

Ransomware continues to be a problem throughout the safety world. Thanks to the pandemic, a collection of new lives and features are growing to make malware operators more formidable.

The use of both cloud computing (also known as ransomware as a service, or RaaS for short) and extortion technology is nothing new, but more often, more sophisticated and targeted methods than ever before. It is deployed in. This increased the overall ransom attack and required payment. 

 

RaaS, like any other cloud service provider, uses a combination of software subscription services and affiliate programs to check in malware distributors. Affiliates earn commissions even if they sell books on Amazon or crafts on Etsy. Commissions typically range from 10% to 40% of successful ransom payments received. The most important difference from the legal world is that they are usually made in cryptocurrencies.

The RaaS model means that almost everyone can enter this market and leverage the coding abilities of others. Affiliates don't have to worry about building and maintaining their malware infrastructure. Each affiliate is given a custom identifier code, much like the behaviour of a legitimate program. This will credit the affiliate and collect acceptable commissions for the attack.

 

In a nutshell, different RaaS groups are often divided into three groups.

1. An emerging crew member who is just getting started and has a few notable incidents. These include Exorcist, Rolkek, and Rush.
2. An emerging power centre that has successfully attacked and maintains a blog that advertises its services and embarrasses victims. This group includes Darkside, Thanos, and Clop.
3. Leading organizations that have had numerous publicly announced attacks, such as DoppelPaymer, Revil, and Ryuk, and are being targeted for enforcement.

 

Darkside detailed checkout

The dark side group is worth special attention. It has three important features:

1. Very sophisticated victim targeting. Find the wealthiest data source to blackmail
2. A more "corporate" approach, including well-developed affiliate operations (paying about 25% affiliate fees).
3. Deliver customized ransomware for each target and do a lot of research work before selecting a target. 

 

Darkside says it doesn't target hospitals and schools, but that's not always the case. They are also looking for Russian-speaking programmers, avoiding Russian targets.

Darkside has announced its creation thanks to a "press release" published on Tor in the summer of 2020. This trick is very clever, as releases tend to attract IT press coverage and can also be used to advertise the source of stolen data. (The devil group also uses this tactic.) Of course, accepting what they promised is probably not a good idea. This release is just one part of how Darkside appears as a "company." It also provides affiliates with text chat support and creates a customized data storage mechanism to hide the stolen data of the target. Darkside has also developed both Windows-based and Linux-based exploits. The first compromise on a Windows PC installs PowerShell scripts, immediately removes Volume Shadow Copies, and prepares various databases and email repositories for encryption and offsite copying. Malware typically enters your organization through a compromised third-party account and attempts to access your virtual desktop session.

 

Darkside also tried to donate money to two charities last summer, but these donations are usually returned because they rely on stolen money and are not legal in most jurisdictions. Speaking of stolen funds, one report reports that Darkside is using an Iranian hosting facility for its criminal network, hosting a command and control server and stolen data. This helps keep their network out of the hands of US and EU authorities who may try to stop their activities.

The group's activity surged from October to December 2020, more than quadrupling the number of samples submitted on the dark side. Ransom demands in the past ranged from $ 200,000 to $ 2 million, depending on the size of the infringed organization.

 

But they are gaining momentum again. In March 2021, managed service vendor CompuCom was the victim of a Darkside attack. The company finally revealed in a FAQ posted to the customer that Darkside was suspected to be the cause.

 

If you are infected with Darkside, prepare it like any other form of ransomware. Make sure your backups are complete and accurate, enhance phishing awareness and education, and lock your account with MFA.

 For ransomware protection, antivirus software can turn out to be of great help.