DarkSide (Windows)

Aliases: BlackMatter

Malware type
ransomware
Family
Malware family
Last IoC activity
2026-07-22 02:36:16
Profile updated
2026-07-07 12:58:17

Targeted industries: energy-and-utilities financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications

Context

FireEye describes DARKSIDE as a ransomware written in C and configurable to target files whether on fixed, removable disks, or network shares. The malware can be customized by the affiliates to create a build for specific victims.

Detection coverage

  • 4 YARA rules

Detection rules

  • DITEKSHEN_MALWARE_Win_Blackmatter (yara-rule)
  • DITEKSHEN_MALWARE_Win_Exmatter (yara-rule)
  • SEKOIA_Ransomware_Win_Blackmatter (yara-rule)
  • MALPEDIA_Win_Blackmatter_Auto (yara-rule)

Reports & references

  • CrowdStrike — Report2021Gtr (report)
  • CrowdStrike — Carbon Spider Sprite Spider Target Esxi Servers With Ransomware (report)
  • youtube.com — Watch (report)
  • secureworks.com — Gold Waterfall (report)
  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • Mandiant — Shining A Light On Darkside Ransomware Operations (report)
  • cloud.google.com — Darkside Affiliate Supply Chain Software Compromise (report)
  • CrowdStrike — Carbon Spider Embraces Big Game Hunting Part 1 (report)
  • CrowdStrike — Big Game Hunting On The Rise Again According To Ecrime Index (report)
  • CrowdStrike — How Big Game Hunting Ttps Shifted After Darkside Pipeline Attack (report)
  • docs.google.com — 1Mi8Z2Tbhmqq5X8Wf Ozv3Dvjz5Sjos 3 (report)
  • ke-la.com — How Ransomware Gangs Find New Monetization Schemes And Evolve In Marketing (report)
  • krebsonsecurity.com — Ransomware Gangs And The Name Game Distraction (report)
  • news.sophos.com — The Ransomware Threat Intelligence Center (report)
  • Broadcom/Symantec — The Ransomware Threat September 2021 (report)
  • therecord.media — An Interview With Blackmatter A New Ransomware Group Thats Learning From The Mistakes Of Darkside And Revil (report)
  • therecord.media — Darkside Gang Estimated To Have Made Over 90 Million From Ransomware Attacks (report)
  • vulnerability.ch — Ransomware And Date Leak Site Publication Time Analysis (report)
  • accenture.com — Evolving Danger Ransomware Extortion (report)
  • bleepingcomputer.com — Blackmatter Ransomware Gang Rises From The Ashes Of Darkside Revil (report)
  • bleepingcomputer.com — Darkside Ransomware Made 90 Million In Just Nine Months (report)
  • bleepingcomputer.com — Popular Russian Hacking Forum Xss Bans All Ransomware Topics (report)
  • coveware.com — Ransomware Attack Vectors Shift As New Software Vulnerability Exploits Abound (report)
  • CrowdStrike — Carbon Spider Sprite Spider Target Esxi Servers With Ransomware (report)
  • CrowdStrike — How To Defend Against Conti Darkside Revil And Other Ransomware (report)

External references