Loading story…
Mandiant reported that DARKSIDE operated as a ransomware-as-a-service group that combined data theft and file encryption, with affiliates conducting intrusions that moved from initial access to hands-on-keyboard post-exploitation before deploying ransomware. The group’s operations were associated with common enterprise attack tooling and tradecraft designed to blend into Windows environments, helping operators maintain access, move laterally, and prepare victim networks for extortion.
The referenced techniques and detections show how that activity can appear on endpoints: adversaries may abuse trusted Microsoft utilities Regsvcs and Regasm under MITRE ATT&CK T1218.009 to proxy malicious .NET code execution and evade application controls, while post-compromise activity may also surface through Cobalt Strike named pipes tied to Beacon, Artifact Kit, and Malleable C2 profiles. Splunk previously published analytics based on Sysmon Event IDs 17 and 18 to identify those pipe patterns, underscoring how defenders can spot the command-and-control and lateral movement behavior often seen in ransomware intrusions linked to groups such as DARKSIDE.
TTPs, infrastructure, and targeting history in one profile.
15 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the "Cobalt Strike Named Pipes" analytic from its content library and stated it is no longer maintained or supported. Splunk said the detection was consolidated into the broader "Windows Suspicious C2 Named Pipe" detection.
Acronis published technical analysis stating DarkSide was being delivered through the Zloader botnet, compromised third-party service providers, exploitation of Palo Alto CVE-2019-1579, and exposed Microsoft Exchange vulnerabilities. The report also documented sample behavior, encryption methods, embedded affiliate configuration, and command-and-control domains.
FortiGuard Labs published analysis of a DarkSide variant with uncommon capabilities to enumerate and mount additional disk partitions in multi-boot environments, discover domain controllers via anonymous LDAP, and encrypt files on writable network shares while skipping administrative shares. The report also documented related incident-response findings including Cobalt Strike SMB/HTTPS beacons, Rclone-based exfiltration, WMI shadow copy deletion, PsExec and rundll32 execution, persistence via a created service, and C2 infrastructure tied to 185.180.197[.]86 and tailgatethenation.com.
Splunk Threat Research published a DarkSide ransomware threat update after replicating the payload in a test environment. The post released a DarkSide analytic story and detections for behaviors including ransom note creation, shadow copy deletion via PowerShell, and CMSTPLUA/CMLUA UAC bypass activity.
Mandiant published "Shining a Light on DARKSIDE Ransomware Operations," documenting DARKSIDE ransomware activity. The report is one of the references tied to later Splunk detection content associated with DarkSide ransomware.
A ransomware attack attributed to DarkSide targeted Colonial Pipeline in the United States, prompting the company to proactively shut down the pipeline on Sunday, May 9. The outage raised concerns about fuel prices and how long the disruption would last.
GhouLSec published a technical reverse-engineering analysis of DarkSide ransomware, detailing its execution flow, privilege-escalation methods, persistence, service-killing logic, victim profiling, and encryption design. The post also identified the sample hash afb22b1ff281c085b60052831ead0a0ed300fac0160f87851dacc67d4e158178 and reported attempted communication with securebestapp20[.]com using a generated URL path.
DarkSide announced that it had invaded multiple companies listed on Nasdaq and other stock exchanges, claiming it encrypted core data and threatening to publish stolen information and profit through short-selling if victims refused to pay.
Cobalt Strike published a blog post, "Learn Pipe Fitting for all of your Offense Projects," describing named pipe usage relevant to offense projects. This material is later referenced by Splunk as context for named pipe patterns associated with Cobalt Strike.
MIT Technology Review reported that New Orleans law firm Stone Pigman Walther Wittmann was among the victims listed by DarkSide. The article says the DarkSide attack on the firm occurred in February, and firm representatives said it did not pay the ransom.
Bitdefender Labs published a DarkSide ransomware decryption tool. This represents a new defensive development aimed at helping victims recover encrypted files without paying the ransom.
On 2020-10-11, a user advertised the DarkSide ransomware affiliate program on a Russian-speaking darkweb forum. The post promoted targeting large corporations and said affiliates would receive access to Windows and Linux variants, an admin panel, a leak site, and supporting infrastructure.
DarkSide publicly introduced itself as a ransomware-as-a-service operation. The group presented itself as a big-game hunter with targeting rules and an affiliate-driven business model.
DarkSide began targeted attacks against organizations around August 10, 2020, using customized ransomware builds and double-extortion tactics. The report said observed demands ranged from about $200,000 to $2 million and that at least one victim had already paid more than $1 million.
Elliptic published an analysis stating that DarkSide had netted more than $90 million in bitcoin ransom payments. The report added a financial assessment of the ransomware operation's proceeds that was not reflected in the existing timeline.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 134 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
24 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourcegithub.com
Open sourcevaronis.com
Open sourcelabs.bitdefender.com
Open sourcewikileaks.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceelliptic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BlackCat/ALPHV operators were linked to intrusions that began with exploitation of vulnerable **Microsoft Exchange** servers, including **`CVE-2021-31207`** in ProxyShell-style activity and other unpatched Exchange exposures. Investigators observed the attackers planting **ASPX web shells**, using IIS worker processes to launch PowerShell, and establishing persistence and remote access with tools including **MobaXterm**. In one case, a tampered **`libeay32.dll`** was downloaded to sideload **Cobalt Strike**, while post-compromise activity included credential theft through **Mimikatz** or **LSASS** dumping with Process Hacker, along with account and network discovery using **SoftPerfect Network Scanner**, **NetScan**, **BloodHound**, **Inveigh**, and **CrackMapExec**. Before encryption, the operators compressed targeted data with **WinRAR** or **7-Zip** and exfiltrated files through **rclone**, **MEGAsync**, and in some cases **FileZilla** or **WinSCP**. Lateral movement and staging were carried out over SMB, including use of **SysVol** shares and local paths such as **`C:\Windows\debug`**, followed by permission changes, shadow copy deletion, recovery disabling, and log clearing. Researchers also identified a newer BlackCat variant with previously undocumented command-line options including **`--safeboot`** and **`--sleep-restart`**, underscoring the group’s continued ability to target **Windows, Linux, and VMware ESXi** environments while pairing encryption with data theft and Tor-based extortion.
Aug 15, 2026
Attackers behind a **Midas ransomware** intrusion spent at least two months inside an unnamed technology vendor before launching encryption, using a combination of internal **RDP**, **PowerShell**, **DISM**, **AnyDesk**, **TeamViewer**, and **Process Hacker** (now known as **System Informer**) to move laterally and prepare the environment. Investigators found evidence that the intruders gained administrator-level access to a domain controller, harvested credentials with **Mimikatz**, exfiltrated data, and repeatedly created malicious **Windows services** to maintain access and stage the attack. The operation culminated in the deployment of a malicious `DismCore.dll` through **DLL sideloading** and the start of ransomware activity on a limited number of servers. Response efforts interrupted the attack before broader encryption could occur, but the case highlighted how a flat network, unused remote-access tools, weak monitoring, and the absence of **MFA** increased the victim’s exposure and enabled the attackers to establish persistence, escalate privileges, and advance toward ransomware execution.
Aug 14, 2026
Trend Micro reported a **Cobalt Strike** intrusion that began with a socially engineered spear-phishing email carrying a malicious **`.xls`** attachment. The file triggered **`excel.exe`**, which spawned **`rundll32.exe`**, loaded **`iroto.tio`**, and hollowed **`mobsync.exe`** to conduct reconnaissance and establish command-and-control activity. Managed XDR and Vision One alerts helped investigators reconstruct the attack chain and identify the initially compromised endpoint as **Patient Zero**. The investigation linked activity across multiple endpoints through indicators of compromise, suspicious process chains, **SMB-based lateral movement**, and evidence of **Pass-the-Hash** abuse. Trend Micro said responders moved to isolate affected systems, reset compromised accounts, block command-and-control infrastructure, and continue monitoring to prevent the intrusion from progressing to a likely ransomware stage.
Aug 14, 2026