DarkSide Ransomware Variant Targets Disk Partitions
A newly discovered DarkSide ransomware variant can detect and compromise partitioned hard drives, researchers report.
Researchers have discovered a DarkSide variant capable of seeking out partition information and compromising multiple disk partitions, a behavior they have not yet seen in ransomware.
The variant was written by the DarkSide group connected to the attack on Colonial Pipeline, though FortiGuard Labs researchers who found it say it was not used in the pipeline attack. This attack currently appears to be limited to targeted organizations, they say, and it is not the result of "widespread wormlike activity."
At the time they found it, researchers believed this ransomware was "seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files," they state in a blog post. Further analysis revealed attackers have a more sophisticated technique: This DarkSide variant seeks out partitions on a multiboot system to find additional files to encrypt. As a result, it can cause more damage and put pressure on organizations to pay the ransom.
This variant also looks for the domain controller and connects to its Active Directory via LDAP anonymous authentication, researchers state, noting that attackers are aware Active Directory is "basically a goldmine of network information."
The DarkSide ransomware is "efficient and well-constructed," the researchers wrote, which signifies the organization includes experienced software engineers. Given the sophistication of the malware, they believe this is not the work of one person but a group with significant resources and time.
Read the full Fortinet blog post for more information.
About the Author(s)
You May Also Like
Why Effective Asset Management is Critical to Enterprise Cybersecurity
May 21, 2024Finding Your Way on the Path to Zero Trust
May 22, 2024Extending Access Management: Securing Access for all Identities, Devices, and Applications
June 4, 2024Assessing Software Supply Chain Risk
June 6, 2024Preventing Attackers From Wandering Through Your Enterprise Infrastructure
June 19, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024