Dharma affiliates do not appear to discriminate among industries. Dharmaĭharma has been in operation since 2016 under a RaaS model, where developers license or sell ransomware to other criminals who then carry out an attack using the malware. It was later reported Colonial Pipeline had approximately 100GB of data stolen from their network, and the organisation allegedly paid almost $5 million USD to a DarkSide affiliate. On 10 2021, the FBI publicly indicated the Colonial Pipeline incident involved the DarkSide ransomware.

DarkSideĭarkSide ransomware is a Ransomware as a Service (RaaS) operation associated with an eCrime group with operators traditionally focused on Windows machines and have recently expanded to Linux, targeting enterprise environments running unpatched VMware ESXi hypervisors or stealing vCenter credentials. The ransom demand for victims was relatively small - an amount between $100 and $300 USD - and payable in a variety of digital currencies including cashU, Ukash, Paysafe, MoneyPak, and Bitcoin (BTC). The group decided to develop their own ransomware and deploy it to a subset of their botnet’s infected systems.

CryptoLocker ransomware was developed by the so-called BusinessClub that used the massive Gameover Zeus botnet with over a million infections. Screen lockers virtually disappeared after the introduction of a ransomware group known as CryptoLocker in 2013. An example of this portal is shown below: The payment portal included the title “Bit paymer” along with a reference ID, a Bitcoin (BTC) wallet, and a contact email address. In its first iteration, the BitPaymer ransom note included the ransom demand and a URL for a TOR-based payment portal.

Our threat intelligence team has been tracking the original BitPaymer since it was first identified in August 2017.

Crypto locker source code