DarkSide Ransomware Variant Targets Disk Partitions

Researchers have discovered a DarkSide variant capable of seeking out partition information and compromising multiple disk partitions, a behavior they have not yet seen in ransomware.

The variant was written by the DarkSide group connected to the attack on Colonial Pipeline, though FortiGuard Labs researchers who found it say it was not used in the pipeline attack. This attack currently appears to be limited to targeted organizations, they say, and it is not the result of "widespread wormlike activity."

At the time they found it, researchers believed this ransomware was "seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files," they state in a blog post. Further analysis revealed attackers have a more sophisticated technique: This DarkSide variant seeks out partitions on a multiboot system to find additional files to encrypt. As a result, it can cause more damage and put pressure on organizations to pay the ransom.

This variant also looks for the domain controller and connects to its Active Directory via LDAP anonymous authentication, researchers state, noting that attackers are aware Active Directory is "basically a goldmine of network information."

The DarkSide ransomware is "efficient and well-constructed," the researchers wrote, which signifies the organization includes experienced software engineers. Given the sophistication of the malware, they believe this is not the work of one person but a group with significant resources and time.

Read the full Fortinet blog post for more information.