Darkside

Aliases: BlackMatter

First seen
2020-08-01 00:00:00
Malware type
ransomware
Family
Malware family
Related IoCs
38 (36 malicious)
Last IoC activity
2026-10-17 10:31:39
Profile updated
2026-07-07 12:58:09

Targeted industries: energy-and-utilities financial-services manufacturing technology-and-telecommunications

Context

Darkside, the latest ransomware operation to emerge has been attacking organizations beginning earlier this month. Darkside’s customized attacks on companies have already garnered them million-dollar payouts. Through their “press release”, these threat actors have claimed to be affiliated with prior ransomware operations making millions of dollars. They stated that they created this new product to match their needs, as prior products didn’t. Darkside explains that they only target companies they know that can pay the specified ransom. They have allegedly promised that they will not attack the following sectors. They include medicine, education, non-profit organizations, and the government sector.

Detection coverage

  • 12 YARA rules

Detection rules

  • MALPEDIA_Win_Blackmatter_Auto (yara-rule)
  • SEKOIA_Ransomware_Win_Blackmatter (yara-rule)
  • DITEKSHEN_MALWARE_Win_Blackmatter (yara-rule)
  • DITEKSHEN_MALWARE_Win_Exmatter (yara-rule)
  • MALPEDIA_Win_Darkside_Auto (yara-rule)
  • SIGNATURE_BASE_MAL_RANSOM_Darkside_May21_1 (yara-rule)
  • SIGNATURE_BASE_MAL_Ransomware_Win_DARKSIDE_V1_1 (yara-rule)
  • SIGNATURE_BASE_MAL_Dropper_Win_Darkside_1 (yara-rule)
  • DITEKSHEN_INDICATOR_KB_ID_Ransomware_Darkside (yara-rule)
  • TRELLIX_ARC_RANSOM_Darkside (yara-rule)
  • TRELLIX_ARC_RANSOM_Darkside_DLL_May2021 (yara-rule)
  • ARKBIRD_SOLG_RAN_ELF_Darkside_Apr_2021_1 (yara-rule)

Reports & references

  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • CrowdStrike — Carbon Spider Embraces Big Game Hunting Part 1 (report)
  • nozominetworks.com — Colonial Pipeline Ransomware Attack Revealing How Darkside Works (report)
  • nozominetworks.com — How To Analyze Malware For Technical Writing (report)
  • repubblica.it — Un Sospetto Attacco Telematico Blocca Le Filiali Della Bcc Di Roma 298485827 (report)
  • reuters.com — Colonial Pipeline Halts All Pipeline Operations After Cybersecurity Attack 2021 05 08 (report)
  • secjuice.com — Blue Team Detection Darkside Ransomware (report)
  • sentinelone.com — Meet Darkside And Their Ransomware Sentinelone Customers Protected (report)
  • splunk.com — Darkside Ransomware Splunk Threat Update And Detections (report)
  • splunk.com — The Darkside Of The Ransomware Pipeline (report)
  • technologyreview.com — Colonial Pipeline Ransomware Bitdefender (report)
  • Trend Micro — What We Know About Darkside Ransomware And The Us Pipeline Attac (report)
  • varonis.com — Darkside Ransomware (report)
  • wsj.com — Colonial Pipeline Ceo Tells Why He Paid Hackers A 4 4 Million Ransom 11621435636 (report)
  • zawadidone.nl — Darkside Ransomware Analysis (report)
  • zawadidone.nl — Darkside Ransomware Analysis (report)
  • zetter.substack.com — Anatomy Of One Of The First Darkside (report)
  • ransomlook.io — Blackmatter (report)
  • blog.qualys.com — Darkside Ransomware (report)
  • abcnews.go.com — Story (report)
  • cybersecurity.att.com — Darkside Raas In Linux Version (report)
  • krebsonsecurity.com — Darkside Ransomware Gang Quits After Servers Bitcoin Stash Seized (report)
  • otx.alienvault.com — 60D0Afbc395C24Edefb33Bb9 (report)
  • pylos.co — Mind The Air Gap (report)
  • guidepointsecurity.com — From Zloader To Darkside A Ransomware Story (report)

External references