Skip to content

[Intel]: https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html #321

@timb-machine

Description

@timb-machine

Area

Malware reports

Parent threat

Execution, Persistence, Privilege Escalation, Command and Control, Exfiltration, Impact

Finding

https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html

Industry reference

attack:T1048:Exfiltration Over Alternative Protocol
attack:T1567:Exfiltration Over Web Service
attack:T1573:Encrypted Channel
attack:T1071.001:Web Protocols
attack:T1053.003:Cron
attack:T1486:Data Encrypted for Impact

Malware reference

DarkSide

Actor reference

UNC2628
UNC2659
UNC2465

Component

Linux

Scenario

No response