IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

DarkSide ransomware targets hidden files in disk partitions

Colonial Pipeline hackers are behind this new strain

Security researchers have discovered that the hackers behind the Colonial Pipeline have developed a new strain of ransomware that targets disk partitions used to hide backup files.

With ransomware becoming more prevalent, administrators have hidden files on disks to prevent systems from being compromised. But according to Fortinet, the cyber criminal gang behind the DarkSide ransomware has developed a malware variant that looks for partitions on a multiboot system to find additional files to encrypt, thereby causing greater damage and an increased incentive to pay a ransom to recover files.

Researchers said this variant is not the version used to disrupt Colonial Pipeline operations. It was programmed efficiently with very little wasted space and minimal compiler bloat, which experts say is unusual for most malware. The file size is relatively small for malware (57,856 bytes) but can deliver a much larger than expected payload, warned researchers.

As well as looking for hidden partitions, the ransomware variant hunts for domain controllers within an organization and connects to its active directory via LDAP anonymous authentication, using a null password and a null username.

“This DarkSide variant may then use COM to interface with Active Directory itself. If successful, the malware attempts to delete certain variables, such as defaultNamingContext and dnsHostName,” said researchers.

Following a query of an organization’s Active Directory, the ransomware then attempts to encrypt files in network shares in this section of the code. Researchers noted that the variant avoids network shares named C$ and ADMIN$, as attempts to access them could trigger an alert.

Related Resource

2021 state of email security report: Ransomware on the rise

Securing the enterprise in the COVID world

2021 state of email security report: Ransomware on the rise - whitepaper from MimecastFree download

The variant also scans hard drives to carry out more actions. In this case, it scans the drive to see if it’s a multiboot system to find additional volumes/partitions to try and encrypt their files as well.

Researchers said the malware’s C2 servers were co-located in the US with KingServers B.V.

“KingServers has been classified as a bulletproof host by the infosec community, and although based in the Netherlands, it has ties to Russia, where DarkSide is located,” said researchers.

Researchers added that due to the sophistication of its attacks and code, it’s also unlikely the mastermind of one person.

“The level of detail, effort, planning and time that the group has undertaken, not only creating the ransomware itself, but taking the time to note what data was stolen, the amount of data, what it contained (as well as how much data in GB), and then taken to organize and shame victims all highlight that this is the work of an organization with considerable resources and time,” added researchers.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022

Most Popular

FCC commissioner urges Apple and Google to remove TikTok from app stores
data protection

FCC commissioner urges Apple and Google to remove TikTok from app stores

29 Jun 2022
LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022