Inside DarkSide: Researchers share intel on break-out cyber gang

Multifaceted extortion operation

The Mandiant team said it was clear that the DarkSide gang was becoming very proficient at “multifaceted extortion operations”. It noted the recent release of information suggesting that DarkSide would target NASDAQ and other listed companies by leaking their attacks to friendly traders in advance so they could short the victims and profit from any impact on the stock price.

“In another notable example,” they said, “an attacker was able to obtain the victim’s cyber insurance policy and leveraged this information during the ransom negotiation process, refusing to lower the ransom amount given their knowledge of the policy limits.

“This reinforces that during the post-exploitation phase of ransomware incidents, threat actors can engage in internal reconnaissance and obtain data to increase their negotiating power. We expect that the extortion tactics that threat actors use to pressure victims will continue to evolve throughout 2021.”

Tactics, techniques and procedures

They may be innovators in some regards, but for defenders concerned with stopping a DarkSide attack before it happens, researchers seem to agree that the DarkSide gang’s technological tactics, techniques and procedures (TTPs) also reflect other ransomwares, incorporating a mix of native Windows features, commodity malware and off-the-shelf red team tools such as Cobalt Strike.

The gang outsources compromise and deployment to network penetration specialists, who then refer the customer service operation back to the core operators. Sophos’ team believes these affiliates are likely hired guns who provide the same service to DarkSide’s peers. FireEye Mandiant confirmed this, saying it believes affiliates have also been associated with Babuk and REvil.

“In Sophos’ experience in data forensics and incident response to DarkSide attacks, the initial access to the target’s network came primarily as a result of phished credentials,” said the Sophos team. “This is not the only way ransomware attackers can gain a foothold, but it seems to be prevalent in cases involving this type of ransomware, possibly as a result of the affiliates’ preferences.”

Mandiant said it had also seen exploitation of CVE-2021-20016, a SQL injection vulnerability in the SonicWall SSLVPN SMA100 product that lets an unauthenticated attacker perform SQL queries to access usernames, passwords and other session-related information (if you are a SonicWall user, you should have patched this by now).

Mandiant tracks DarkSide activity in three different clusters of different groups – it defines these as UNC2628, UNC2659 and UNC2465 – that use differing methods of establishing persistence. Among other tools, UNC2628 favours the Cobalt Strike framework and BEACON payloads, sometimes uses Mimikatz for credential theft and exfiltration, and has even deployed F-Secure’s custom command and control framework. Meanwhile, UNC2659 uses TeamViewer to establish persistence, and UNC2465, the oldest cluster of activity linked to DarkSide, delivers the PowerShell-based .NET backdoor known as SMOKEDHAM.

Once established, Sophos’ intelligence has the gang’s dwell time at a median of 45 days, but it has been known to kick back for up to 88 days, during which time it steals as much data as possible, often targeting multiple departments inside the victim organisation – accounting and research and development (R&D) are particularly favoured here.

The gang moves around inside the victim network using PSExec and remote desktop connections – SSH if on a Linux server – and uploads its treasure trove to the cloud storage providers Mega or pCloud. Victims are extorted in bitcoin or monero – Sophos notes the gang does not accept Elon Musk’s favoured dogecoin.

“While some recent targeted ransomware operations from other gangs have sprung quickly, launching their attack within days, the actors behind DarkSide campaigns may spend weeks to months poking around inside an organisation’s network before activating their ransomware payload,” said the Sophos team.