DarkSide (ELF)
- First seen
- 2020-08-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:59:45
Targeted industries: energy-and-utilities financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications
Targeted regions: country_code:us country_code:de country_code:gb
Context
DarkSide is a notorious ransomware that targets large organizations, encrypting their data and demanding a ransom for decryption. It has been known for its sophisticated operations, often exfiltrating data for additional extortion leverage.
Reports & references
- secureworks.com — Ransomware Groups Use Tor Based Backdoor For Persistent Access (report)
- CrowdStrike — Carbon Spider Sprite Spider Target Esxi Servers With Ransomware (report)
- youtube.com — Watch (report)
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- blog.group-ib.com — Blackmatter (report)
- blog.group-ib.com — Blackmatter2 (report)
- blogs.blackberry.com — Threat Thursday Blackmatter Ransomware As A Service (report)
- therecord.media — Darkside Ransomware Gang Moves Some Of Its Bitcoin After Revil Got Hit By Law Enforcement (report)
- twitter.com — 1451465959894667275 (report)
- bleepingcomputer.com — Darkside Ransomware Rushes To Cash Out 7 Million In Bitcoin (report)
- elliptic.co — Darkside Bitcoins On The Move Following Government Cyberattack Against Revil Ransomware Group (report)
- youtube.com — Watch (report)
- blog.gigamon.com — Tracking Darkside And Ransomware The Network View (report)
- medium.com — W1 Jun En Story Of The Week Ransomware On The Darkweb Af491D33868B (report)
- securityscorecard.com — New Evidence Supports Assessment That Darkside Likely Responsible For Colonial Pipeline Ransomware Attack Others Targeted (report)
- therecord.media — Popular Hacking Forum Bans Ransomware Ads (report)
- twitter.com — 1388301138437578757 (report)
- bleepingcomputer.com — Chemical Distributor Pays 44 Million To Darkside Ransomware (report)
- bleepingcomputer.com — Darkside Ransomware Servers Reportedly Seized Revil Restricts Targets (report)
- CrowdStrike — Falcon Protects From Darkside Ransomware (report)
- CrowdStrike — How Ransomware Adversaries Reacted To The Darkside Pipeline Attack (report)
- elliptic.co — Darkside Ransomware Has Netted Over 90 Million In Bitcoin (report)
- elliptic.co — Elliptic Follows Bitcoin Ransoms Paid By Darkside Ransomware Victims (report)
- ic3.gov — 211101 (report)
- intel471.com — Darkside Ransomware Shut Down Revil Avaddon Cybercrime (report)