DarkSide (Windows)
Aliases: BlackMatter
- Malware type
- ransomware
- Family
- Malware family
- Related IoCs
- 22 (21 malicious)
- Last IoC activity
- 2026-10-16 06:36:40
- Profile updated
- 2026-07-07 12:58:17
Targeted industries: energy-and-utilities financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications
Context
FireEye describes DARKSIDE as a ransomware written in C and configurable to target files whether on fixed, removable disks, or network shares. The malware can be customized by the affiliates to create a build for specific victims.
Detection coverage
- 4 YARA rules
Detection rules
- MALPEDIA_Win_Blackmatter_Auto (yara-rule)
- DITEKSHEN_MALWARE_Win_Blackmatter (yara-rule)
- DITEKSHEN_MALWARE_Win_Exmatter (yara-rule)
- SEKOIA_Ransomware_Win_Blackmatter (yara-rule)
Reports & references
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- CrowdStrike — Carbon Spider Embraces Big Game Hunting Part 1 (report)
- nozominetworks.com — How To Analyze Malware For Technical Writing (report)
- repubblica.it — Un Sospetto Attacco Telematico Blocca Le Filiali Della Bcc Di Roma 298485827 (report)
- reuters.com — Colonial Pipeline Halts All Pipeline Operations After Cybersecurity Attack 2021 05 08 (report)
- secjuice.com — Blue Team Detection Darkside Ransomware (report)
- sentinelone.com — Meet Darkside And Their Ransomware Sentinelone Customers Protected (report)
- splunk.com — Darkside Ransomware Splunk Threat Update And Detections (report)
- splunk.com — The Darkside Of The Ransomware Pipeline (report)
- technologyreview.com — Colonial Pipeline Ransomware Bitdefender (report)
- Trend Micro — What We Know About Darkside Ransomware And The Us Pipeline Attac (report)
- varonis.com — Darkside Ransomware (report)
- wsj.com — Colonial Pipeline Ceo Tells Why He Paid Hackers A 4 4 Million Ransom 11621435636 (report)
- zawadidone.nl — Darkside Ransomware Analysis (report)
- zawadidone.nl — Darkside Ransomware Analysis (report)
- zetter.substack.com — Anatomy Of One Of The First Darkside (report)
- digitalshadows.com — Darkside The New Ransomware Group Behind Highly Targeted Attacks (report)
- blog.group-ib.com — Blackmatter (report)
- blog.group-ib.com — Blackmatter2 (report)
- blogs.blackberry.com — Threat Thursday Blackmatter Ransomware As A Service (report)
- therecord.media — Darkside Ransomware Gang Moves Some Of Its Bitcoin After Revil Got Hit By Law Enforcement (report)
- twitter.com — 1451465959894667275 (report)
- bleepingcomputer.com — Darkside Ransomware Rushes To Cash Out 7 Million In Bitcoin (report)
- CrowdStrike — Carbon Spider Embraces Big Game Hunting Part 2 (report)
- elliptic.co — Darkside Bitcoins On The Move Following Government Cyberattack Against Revil Ransomware Group (report)