Dharma
Dharma is a ransomware family, including ransomware-as-a-service activity, that has been repeatedly cited alongside other major extortion operations. The provided content describes Dharma as one of the ransomware families historically appearing in top ransomware prevalence rankings and as a variant associated with re-extortion, where victims may be pressured for additional payments after an initial ransom event. Multiple sources in the content characterize Dharma as similar to Phobos, Makop, and Waiting, and note that these variants have been open to a broad range of threat actors. The content also characterizes Dharma as a low-level RaaS strain used in "spray and pray" attacks against smaller targets, and separately notes that Phobos and Dharma attacks were down about 37% year-to-date in 2023 versus the same period in 2022, with some affiliates reportedly shifting to 8base.
Based on the supporting material, Dharma campaigns have used legitimate, digitally signed administrative or troubleshooting tools to impair defenses prior to ransomware deployment. Seqrite-linked reporting in the content states that Dharma intrusions often begin with phishing emails or compromised credentials. Observed tooling in Dharma-associated campaigns includes IOBit Unlocker and Process Hacker to disable antivirus or other security software, PowerRun to obtain SYSTEM-level control, YDArk for kernel-level or elevated control, Mimikatz for credential theft, and Unlock_IT to erase logs and hinder forensic investigation. The content also explicitly states that IOBit Unlocker has been used in Dharma campaigns and that abuse of legitimate low-level tools has become a defining feature of campaigns involving Dharma and other ransomware families.
The content further links Dharma to broader law-enforcement activity. Ukraine's Cyber Police reportedly detained suspects in November 2022 involved in LockerGoga, MegaCortex, Hive, and Dharma ransomware attacks, and later investigations and arrests in Ukraine were again described as involving the Dharma ransomware family. Financially, the content includes reporting that a wallet received proceeds from Dharma, Conti, and BlackCat, indicating affiliate or operator overlap in the wider ransomware ecosystem. Payment-related reporting in the content describes Dharma as generally associated with smaller payments than major big-game-hunting strains, including one dataset listing Dharma average and median payments at very low levels and another noting Dharma among strains affecting very small businesses.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Impact
1 technique
Impact
Other
2 techniques
Other
Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.
Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities... killing security software processes or services, modifying / deleting Registry keys or configuration files... Adversaries may also disable updates...
Recent activity
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware observed in campaigns that weaponize legitimate signed utilities to disable security tools and support ransomware execution.
Ransomware family mentioned as leveraging IOBit Unlocker in campaigns to aid attack execution.
Ransomware family listed among campaigns that neutralize defenses with legitimate tools before deploying encryption payloads.
Ransomware family cited as a source of leaked code/builders used to spawn new variants.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.