DarkSide Ransomware

The DarkSide Ransomware is a file-locking Trojan that can block files on Windows computers with encryption. The DarkSide Ransomware targets entities with significant financial resources, such as enterprise-level businesses preferentially, and claims that it collects data for blackmail purposes. Server administrators should maintain strict security protocols for preventing infections, backups for content recovery, and anti-malware tools to spot and remove the DarkSide Ransomware.

A Trip to the Darker Side of Server Software

Despite the extreme prominence of Ransomware-as-a-Services taking over from the previous industry death-grip of Hidden Tear freeware, there also are independently-operating Trojans that are out in the wild and endangering users' files. Of this category, malware experts declare the DarkSide Ransomware as one of the most costly file-locker Trojans in existence for any unfortunate victims. The Windows Trojan isn't very different from common examples of its threat classification, except for some of its warnings and high expectations.

The DarkSide Ransomware is a Windows Trojan that leverages encryption for creating 'locked' copies of files, such as documents, and then deletes the original ones. So far, malware experts estimate that the extension it adds to the media file's name is random ('d0ac7d95,' etc.). The security of the encryption requires further analysis but is unlikely to be vulnerable to the usual means of unlocking solutions.

The DarkSide Ransomware creates an English Notepad note that holds its demands for selling the unlocker and restoring the victim's files. The instructions anticipate business server-based entities as the targets, instead of home users, and threatens to release the server's data on the Web as a penalty for nonpayment. Although malware researchers can't confirm a data-uploading function in the DarkSide Ransomware's payload, the Trojan's threat actors may accomplish such attacks through manual methods (like enabling RDP or using another threat for a backdoor, first).

Lightening Up a DarkSide Ransomware Attack

Ransom prices from the DarkSide Ransomware are most likely subject to readjustment according to the contents of each victim's server. However, the numbers available to malware researchers, at this time, suggest that the DarkSide Ransomware expects payments of over two thousand dollars in cryptocurrency. Its message also emphasizes the risk, not just of losing any files, but of having documents put on the Web for public viewing.

Secured backups are a universally-strong antidote to file-locking Trojans, including semi-unique ones like the DarkSide Ransomware, Hidden Tear variants, and Ransomware-as-a-Services like the Scarab Ransomware. Besides such precautions, workers should avoid interacting with unusual documents with macros, use passwords that can stand up to brute-force attacks, and use Web-browsing settings that will make them less at risk from a watering hole attack or Exploit Kit. All of these are active strategies for file-locker Trojans that prey on business entities.

As a final option for defense, reliable Windows anti-malware programs will detect and delete the DarkSide Ransomware as a threat in most cases.

The DarkSide Ransomware is as dark as it gets, with blackmail combined with painful prices to get a server's status back to normal. No company can shrug off a digital thug strong-arming their servers, and even less so when the assailant includes such a price for leaving in peace.