How dark is the DarkSide Ransomware Group
May 17, 2021

In the last decade, there has been an exponential increase in cyberattacks on companies all around the world. Till now no other security attack has been as serious as a Ransomware attack. This is because it denies the computer owner the ability to make further use of the computer systems. In some cases, it has resulted in the loss of life because critical medical systems were attacked and could not be brought back live on time. One of the most potent Ransomware groups is the Darkside. In this blog post, I will explore this group and the mode of operation.


What is the “Darkside” Hackers group?

The group has been called “one of the largest and most notorious” ransomware groups. Like other forms of cybercrime, its activities are fuelled by money. Its members, they claim, are not directly affiliated with any government or intelligence agency, but they rely solely on ransom payments to fund their operations.

They use a sophisticated business model know as Ransomware-as-a-Service (RaaS). This enables them to recruit other hackers to help them carry out lots of attacks. Darkside team also has an extensive network of affiliates who can distribute their malware globally through spam campaigns or targeted spear-phishing attacks.

The Ransomware-as-a-Service (RaaS) Model

Interested parties who are not necessarily hackers are recruited and given access to the hacking tools via simple, yet powerful web services to carry out their attacks in almost a point-and-click system. These new recruits are called affiliates and work for the main group. When an attack is successful and the payment is made, the loot will be shared based on the group’s revenue-sharing model.

This is a very effective business model as they even have a “free trial” of their malware to encourage easy adaptation. They also provide tutorials on how people can create and deploy ransomware themselves using the same tools they make available.

In just one month this year over $17.5 million worth of Bitcoin was deposited in a Crypto wallet linked to the hackers.

    • According to the group they have the following revenue sharing model:
    • Dynamic rate of 75% to 90%.
    • A stable rate of 80%.

They also have a trial and more attractive offer for new users:

    • 90% for the first two payouts when you switch to us from any other affiliate program if you had three ransom payments in the last month; each of them needs to be over 2M (and each needs to be verified).
    • 90% for the first two payouts when you switch to us from any other affiliate program.

The group has publicly stated that they prefer to target organizations that can afford large ransoms instead of hospitals, schools, non-profits, and governments. Ransoms demanded by the group have ranged from US$200K to US $20M. The Darkside seems to be experts in hacking oil pipelines and can bypass security measures with ransomware to extort large sums of money.

How the “Darkside” Group Works

DarkSide is believed to be based in Russia, but it is not sponsored by the government. They claimed on their website that members are not allowed to attack the computers of people in Russia, Ukraine, Georgia, or Belarus. Other computers out of reach are those from:

    • Healthcare (only: clinics, hospitals, and palliative care organizations, retirement homes, companies that develop COVID-19 vaccines or take part (to a significant extent, as a part of the supply chain) in supplying them).
    • Funeral services (morgues, crematoria, and funeral parlors).
    • Education (universities, schools).
    • Public sector (municipal services, any public agencies).
    • Non-profit organizations (charitable foundations and associations)

Experts state that the group is one of the many for-profit ransomware groups that have proliferated and thrived in Russia.

Darkside was first noticed in August 2020. They have a professional-looking website and tries to have a Robinhood image. The group claims that they donated some ransom money to charity, and they only target organizations that can afford large ransoms.

The Colonial Pipeline Hack

The Darkside seems to be fun of hacking oil pipelines and is able to bypass security measures with ease due to their expertise, making them a big threat for authorities worldwide. They have hit large oil pipelines at least four times from December 2020 to date. They make use of one of their most potent weapons: The Ryuk.

Ryuk is one of the most recent types of ransomware, and it has proved effective in locking down computers across the world. With Ryuk they can target large organizations with the ability to pay large some of Ransom.

Successful Activities of the “Darkside”.

August 2020:

DarkSide introduces its ransomware.

October 2020:

DarkSide donates US$20,000 stolen from victims to charity.

November 2020:

DarkSide establishes its RaaS model.

November 2020

DarkSide launches its content delivery network (CDN) for storing and delivering compromised data.

March 2021

DarkSide releases version 2.0 of their ransomware with several important updates to make it more sophisticated.

March 2021

They hit the IT managed services provider CompuCom

May 2021
DarkSide launched an attack on the Colonial Pipeline. After the attack, Darkside said that they were not a political organization and would start to check where their targets are.

Attack Method

Darkside has a method of a quick escalation. The longer it takes a victim to comply with the demand the more troubles they get.

Step One: The Ransom Phase

This is the initial delivery phase. In this phase, the ransomware encrypts the files and leaves a ransom note behind while the attackers seat back and wait for payment.

Step two: The Double Extortion Phase.

This is the step the attackers start threatening the victim to release to the public the data it stole if the money is not paid on time. In some cases, additional money is demanded to prevent the public distribution of the stolen data.

This was what happened in the case of Toshiba Tec Corp., a unit of Toshiba Corp, more than 740 gigabytes of information were compromised, and included personal data of personnel such as copies of passports.

The group also likes to hedge their bets by shorting the shares of the companies they hack in the stock market and profiting from the temporary fall of the value of the shares.

The first published case of double extortion happened in November 2019. Allied Universal, a large American security company, was the victim. When Allied refused to pay the demand of 300 Bitcoins the attackers upped the game and threatened to release sensitive information exfiltrated from the company.

To prove they were not kidding, the attackers published some of the files they stole which included contracts, medical records, and encryption certificates.

Step Three: Triple Extortion Phase

In this phase, the victims are threatened with Distributed Denial of Service Attack (DDoS) if they do not pay the ransom. In this phase, if a victim pays up for the first time, then he or she is likely to be targeted by the hackers again and extorted of more money to keep their data safe.

This happened to the German company Brenntag this May 2021, when their systems were hit by ransomware. A DDoS attack took down their IT infrastructure and encrypted data. They ended up paying $4.4 million ransom in Bitcoin to Darkside and still suffered significant downtime.

Step Four: The Final Extortion Phase

If the victim still has not paid then they will get a further escalation. This time they will start getting calls to comply. Sometimes, the clients of the victim will be included at this point to turn up the heat.

Step Five: The Release Phase

After getting paid, hackers will release the data they encrypted by providing the victim with the encryption key to unlock the files. This stage also includes publicizing that a victim has been hacked, so victims cannot deny what happened and know how much money was extorted from them.

Ransomware is one of the most potent security attacks in history. It could result in a loss of life if it takes down critical medical systems. There have been over 2 million ransomware incidents, which means that this attack can happen to anyone!  Therefore, it’s important for every company to take steps towards preventing and mitigating these types of cyberattacks as soon as possible.

If you want help with training your staff and creating awareness on these types of cyberattack please contact us via email at


More Articles