DarkSide ransomware targets hidden files in disk partitions
Colonial Pipeline hackers are behind this new strain


Security researchers have discovered that the hackers behind the Colonial Pipeline have developed a new strain of ransomware that targets disk partitions used to hide backup files.
With ransomware becoming more prevalent, administrators have hidden files on disks to prevent systems from being compromised. But according to Fortinet, the cyber criminal gang behind the DarkSide ransomware has developed a malware variant that looks for partitions on a multiboot system to find additional files to encrypt, thereby causing greater damage and an increased incentive to pay a ransom to recover files.
Researchers said this variant is not the version used to disrupt Colonial Pipeline operations. It was programmed efficiently with very little wasted space and minimal compiler bloat, which experts say is unusual for most malware. The file size is relatively small for malware (57,856 bytes) but can deliver a much larger than expected payload, warned researchers.
As well as looking for hidden partitions, the ransomware variant hunts for domain controllers within an organization and connects to its active directory via LDAP anonymous authentication, using a null password and a null username.
“This DarkSide variant may then use COM to interface with Active Directory itself. If successful, the malware attempts to delete certain variables, such as defaultNamingContext and dnsHostName,” said researchers.
Following a query of an organization’s Active Directory, the ransomware then attempts to encrypt files in network shares in this section of the code. Researchers noted that the variant avoids network shares named C$ and ADMIN$, as attempts to access them could trigger an alert.
RELATED RESOURCE
2021 state of email security report: Ransomware on the rise
Securing the enterprise in the COVID world
The variant also scans hard drives to carry out more actions. In this case, it scans the drive to see if it’s a multiboot system to find additional volumes/partitions to try and encrypt their files as well.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Researchers said the malware’s C2 servers were co-located in the US with KingServers B.V.
“KingServers has been classified as a bulletproof host by the infosec community, and although based in the Netherlands, it has ties to Russia, where DarkSide is located,” said researchers.
Researchers added that due to the sophistication of its attacks and code, it’s also unlikely the mastermind of one person.
“The level of detail, effort, planning and time that the group has undertaken, not only creating the ransomware itself, but taking the time to note what data was stolen, the amount of data, what it contained (as well as how much data in GB), and then taken to organize and shame victims all highlight that this is the work of an organization with considerable resources and time,” added researchers.
Rene Millman is a freelance writer and broadcaster who covers cybersecurity, AI, IoT, and the cloud. He also works as a contributing analyst at GigaOm and has previously worked as an analyst for Gartner covering the infrastructure market. He has made numerous television appearances to give his views and expertise on technology trends and companies that affect and shape our lives. You can follow Rene Millman on Twitter.
-
How to implement a four-day week in tech
In-depth More companies are switching to a four-day week as they look to balance employee well-being with productivity
-
Intelligence sharing: The boost for businesses
In-depth Intelligence sharing with peers is essential if critical sectors are to be protected
-
Hackers breached a 158 year old company by guessing an employee password – experts say it’s a ‘pertinent reminder’ of the devastating impact of cyber crime
News A Panorama documentary exposed hackers' techniques and talked to the teams trying to tackle them
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
News Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so far
News A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'
News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culprits
News Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackers
News While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker group
News An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabs
News An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs