DarkSide Ransomware Variant Targets Disk Partitions

A newly discovered DarkSide ransomware variant can detect and compromise partitioned hard drives, researchers report.

Dark Reading Staff, Dark Reading

May 18, 2021

1 Min Read
Dark Reading logo in a gray background | Dark Reading

Researchers have discovered a DarkSide variant capable of seeking out partition information and compromising multiple disk partitions, a behavior they have not yet seen in ransomware.

The variant was written by the DarkSide group connected to the attack on Colonial Pipeline, though FortiGuard Labs researchers who found it say it was not used in the pipeline attack. This attack currently appears to be limited to targeted organizations, they say, and it is not the result of "widespread wormlike activity."

At the time they found it, researchers believed this ransomware was "seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files," they state in a blog post. Further analysis revealed attackers have a more sophisticated technique: This DarkSide variant seeks out partitions on a multiboot system to find additional files to encrypt. As a result, it can cause more damage and put pressure on organizations to pay the ransom.

This variant also looks for the domain controller and connects to its Active Directory via LDAP anonymous authentication, researchers state, noting that attackers are aware Active Directory is "basically a goldmine of network information."

The DarkSide ransomware is "efficient and well-constructed," the researchers wrote, which signifies the organization includes experienced software engineers. Given the sophistication of the malware, they believe this is not the work of one person but a group with significant resources and time.

Read the full Fortinet blog post for more information.

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights