DarkSide Ransomware Variant Targets Disk Partitions
A newly discovered DarkSide ransomware variant can detect and compromise partitioned hard drives, researchers report.
Researchers have discovered a DarkSide variant capable of seeking out partition information and compromising multiple disk partitions, a behavior they have not yet seen in ransomware.
The variant was written by the DarkSide group connected to the attack on Colonial Pipeline, though FortiGuard Labs researchers who found it say it was not used in the pipeline attack. This attack currently appears to be limited to targeted organizations, they say, and it is not the result of "widespread wormlike activity."
At the time they found it, researchers believed this ransomware was "seeking out partitions to find possible hidden partitions setup by systems administrators to hide backup files," they state in a blog post. Further analysis revealed attackers have a more sophisticated technique: This DarkSide variant seeks out partitions on a multiboot system to find additional files to encrypt. As a result, it can cause more damage and put pressure on organizations to pay the ransom.
This variant also looks for the domain controller and connects to its Active Directory via LDAP anonymous authentication, researchers state, noting that attackers are aware Active Directory is "basically a goldmine of network information."
The DarkSide ransomware is "efficient and well-constructed," the researchers wrote, which signifies the organization includes experienced software engineers. Given the sophistication of the malware, they believe this is not the work of one person but a group with significant resources and time.
Read the full Fortinet blog post for more information.
About the Author
You May Also Like
Transform Your Security Operations And Move Beyond Legacy SIEM
Nov 6, 2024Unleashing AI to Assess Cyber Security Risk
Nov 12, 2024Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024