Loading story…
The DarkSide ransomware operation said it was building a distributed storage platform in Iran to host and publish data stolen from victims, a move intended to make law-enforcement disruption and infrastructure takedowns more difficult. The group described itself as a private ransomware-as-a-service operation in which core developers supply the malware and payment systems while affiliates breach targets and split ransom proceeds.
DarkSide also used a Russian-speaking cybercrime forum to recruit affiliates, claiming participants earn about $400,000 per victim on average, and posted a 20 BTC deposit—worth roughly $320,000 at the time—to signal financial credibility. The gang said it would avoid attacks on healthcare, education, non-profits, and government entities, but the report noted it was unclear whether those restrictions would be enforced in practice.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
The article states that ransomware groups have widely used double extortion since late 2019, stealing unencrypted data before encrypting victim systems and threatening to publish it to pressure victims into paying.
To demonstrate financial credibility to prospective affiliates, DarkSide deposited 20 bitcoins on the hacker forum, worth about $320,000 at the time according to the article.
DarkSide posted on a Russian-speaking hacker forum that it was recruiting new Russian affiliates and building a distributed storage system in Iran or unrecognized republics to host stolen victim data and resist takedowns.
The article references a September recruitment drive by REvil in which the group deposited $1 million in bitcoins on the same Russian-speaking hacker forum as a credibility signal.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blockchain analysis linked **DarkSide** to at least **$90 million** in bitcoin ransom payments over roughly nine months, tracing funds across 47 wallets tied to the ransomware-as-a-service operation. Two of the group’s most prominent victims accounted for about **$10 million** of that total: **Colonial Pipeline**, which paid nearly **$5 million**, and chemical distributor **Brenntag**, which paid **$4.4 million**. The gang’s affiliate model reportedly gave partners **75% to 90%** of each payment, while the core operators retained a smaller share that still amounted to about **$15.5 million** in bitcoin. DarkSide’s campaign also involved data theft as well as encryption. Brenntag said attackers accessed its North America systems in late April 2021, exfiltrating sensitive personal data affecting more than **6,700 individuals**, including Social Security numbers, dates of birth, driver’s license numbers, and some medical information; the company said DarkSide claimed to have stolen **150GB** of data and that access may have been obtained through purchased stolen credentials. After the Colonial Pipeline attack drew intense scrutiny, DarkSide said it lost control of parts of its infrastructure and some ransom funds before abandoning operations, while major cybercrime forums including **XSS**, **Exploit**, and **RAID** banned ransomware advertisements and other gangs shifted toward private affiliate arrangements rather than disappearing entirely.
Aug 15, 2026
Leaked documents reviewed by Flashpoint indicate that Iranian contractor **Emen Net Pasargard (ENP)** ran a state-sponsored ransomware effort dubbed **Project Signal** on behalf of the **Islamic Revolutionary Guard Corps (IRGC)**. The material shows the operation progressing from reconnaissance by ENP’s Studies Center in mid-2020 to execution by its Cyber Directorate, with ransomware attacks beginning in late October 2020. The workflow included Bitcoin payment and decryption procedures, suggesting the campaign may have blended real extortion with an effort to disguise state activity as ordinary criminal ransomware; Flashpoint also noted similarities in timing and tradecraft to the Iran-linked **Pay2Key** campaign targeting Israeli organizations, while stopping short of confirming a direct connection. Separate reporting from Symantec described the sustained activity of **Elfin**/**APT33**, an Iran-linked espionage group that targeted at least 50 organizations across Saudi Arabia, the United States, and other countries in sectors including chemical, engineering, finance, telecoms, healthcare, and manufacturing. The group used spear-phishing, credential theft, commodity RATs, custom malware, and public tools, and in one case attempted to exploit **`CVE-2018-20250`** in WinRAR against a Saudi chemical-sector target. Together, the reports show Iranian operators using both long-term intrusion tradecraft for intelligence collection and ransomware-style operations that can support disruption, coercion, or plausible deniability.
Aug 15, 2026
Ransomware groups are increasingly operating like structured criminal businesses, outsourcing key functions to specialists and launching formal affiliate programs across underground forums. Researchers and reporting describe growing demand for **initial access brokers** and dedicated **negotiators** who handle ransom talks, pressure tactics, and extortion messaging, while forums such as **RAMP** emerged to support ransomware recruitment after other Russian-speaking sites restricted such advertising. New and revived operations have continued to market themselves aggressively, including **Eclipse Ransomware** with a managed affiliate model, Tor-based negotiation portals, leak-site support, and revenue-sharing terms, as well as earlier examples such as REvil-linked infrastructure reappearing to recruit affiliates and Maze partnering with other gangs through shared leak platforms.
Aug 15, 2026