Ransomware.live: darkside

Contact us Buy Me a Coffee

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

| RaaS

Darkside ransomware group has started its operation in August of 2020 with the model of RaaS (Ransomware-as-a-Service). They have become known for their operations of large ransoms scale. They have announced that they prefer not to attack hospitals, schools, non-profits, and governments, but rather big organizations that can be able to pay large ransoms. Darkside ransomware group became very famous following the cyberattack of the Colonial Pipeline and Toshiba unit. The FBI finally terminate the Darkside operation and Managed to pull money from their wallets back.

Victims

10

First Discovered

2020-08-01

victim

Last Discovered

2021-05-13

victim

Inactive Since

5yrs

more than

Avg Delay

N/A

attack→claim

Infostealer

0.0%

victims with domain

Countries

5

hit

View Victims on World Map View Group Statistics

Known Locations (1)

Favicon	Title	Type	Available	Last Visit	Server Info	FQDN
			No	2026-04-28T07:23:34		`darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion`

Target

Heatmap

Ransom Notes (1)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
ADRecon AdFind Advanced IP Scanner SoftPerfect NetScan placeholder	AnyDesk GoToAssist TightVNC placeholder placeholder	placeholder placeholder placeholder placeholder placeholder	Mimikatz SessionGopher placeholder placeholder placeholder	Cobalt Strike CrackMapExec Impacket PowerSploit placeholder	Plink placeholder placeholder placeholder placeholder	PsExec placeholder placeholder placeholder placeholder	Bashupload MEGA RClone Sendspace pCloud

TTPs Matrix (11)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact
Valid Accounts	Windows Management Instrumentation	Exploitation for Privilege Escalation	Obfuscated Files or Information	OS Credential Dumping: LSASS Memory	Network Service Discovery	Remote Services: Remote Desktop Protocol	Archive Collected Data: Archive via Utility	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Application Layer Protocol: Web Protocols	Data Encrypted for Impact
Exploit Public-Facing Application	Command and Scripting Interpreter: PowerShell		Disable or Modify Tools	OS Credential Dumping: NTDS	Domain Trust Discovery	Remote Services: SMB/Windows Admin Shares			Remote Access Software	Service Stop
										Inhibit System Recovery

Negotiation Chats (5)

YARA Rules (1)

Victims (10)