darkrace
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:51:09
Targeted industries: financial-services healthcare-and-pharmaceutical retail-and-hospitality
Context
DarkRace is a moderately destructive ransomware strain observed since 2024. It encrypts files and appends a randomized extension (e.g., .1352FF327) that varies per victim. Implemented as a 32-bit Windows application, it disables antivirus defenses, deletes volume shadow copies, terminates processes, and drops ransom note files for payment negotiation. Technical weaknesses in its encryption have enabled developers to produce a universal decryptor that works against DarkRace and related variants.
Related threat objects
- donex (malware)
Reports & references
- ransomlook.io — Darkrace (report)
- Broadcom/Symantec — Darkrace Ransomware (report)
- Trend Micro — Ransom.Win32.Darkrace.Thcofbd (report)
- helpnetsecurity.com — Decryptor Donex Muse Darkrace Fake Lockbit 3 0 (report)
- petikvx.github.io — Darkrace Ransomware (report)
- salvagedata.com — Darkrace Ransomware (report)