Dharma

Dharma is a ransomware threat actor and associated ransomware operation known for opportunistic intrusions, commonly involving exposed Remote Desktop Protocol access and attacks against smaller organizations or single systems rather than large-scale enterprise-wide compromises. It is frequently discussed alongside closely related or overlapping activity involving Crysis and, in some reporting, affiliates later linked to operations such as 8Base and Phobos. The actor has been observed using legitimate administrative and troubleshooting tools during intrusions for reconnaissance, defense evasion, and post-compromise operations. Reported tradecraft includes network scanning with Advanced IP Scanner; disabling or impairing endpoint protections with utilities such as Defender Control; abusing signed dual-use tools to terminate antivirus processes; obtaining elevated or kernel-level execution through legitimate or semi-legitimate utilities; credential theft with tools such as Mimikatz; and log clearing or other anti-forensic actions. Use of trusted tools to suppress security controls and blend into normal administration is a recurring characteristic. Dharma activity is associated with common ransomware lifecycle behaviors including initial access, internal reconnaissance, credential theft, defense evasion, lateral movement, data exfiltration, and encryption-based extortion. Reporting also links the operation to laundering ransom proceeds through cryptocurrency mixing services. Some reporting references actors believed to be Chinese using Dharma ransomware in at least one extortion case, but this does not establish Dharma itself as a confirmed China-based threat actor. Dharma is best characterized as a financially motivated ransomware operation or ecosystem rather than a nation-state group.