DarkSide Ransomware Variant Targets Disk Partitions
A newly discovered DarkSide ransomware variant can detect and compromise partitioned hard drives, researchers report.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Researchers have discovered a DarkSide variant capable of seeking out partition information and compromising multiple disk partitions, a behavior they have not yet seen in ransomware.
The variant was written by the DarkSide group connected to the attack on Colonial Pipeline, though FortiGuard Labs researchers who found it say it was not used in the pipeline attack. This attack currently appears to be limited to targeted organizations, they say, and it is not the result of "widespread wormlike activity."
At the time they found it, researchers believed this ransomware was "seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files," they state in a blog post. Further analysis revealed attackers have a more sophisticated technique: This DarkSide variant seeks out partitions on a multiboot system to find additional files to encrypt. As a result, it can cause more damage and put pressure on organizations to pay the ransom.
This variant also looks for the domain controller and connects to its Active Directory via LDAP anonymous authentication, researchers state, noting that attackers are aware Active Directory is "basically a goldmine of network information."
The DarkSide ransomware is "efficient and well-constructed," the researchers wrote, which signifies the organization includes experienced software engineers. Given the sophistication of the malware, they believe this is not the work of one person but a group with significant resources and time.
Read the full Fortinet blog post for more information.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024