The DarkSide ransomware gang has informed its affiliates regarding the shut down of its ransomware-as-a-service (RaaS) activity. The statement was made after the public infrastructure of the gang was taken off the internet in what seems to be a police campaign.
On May 13, the DarkSide data leak website was off the internet as well as much of the public infrastructure of the gang, which include the payment server employed to get the victims’ ransom payments and deliver breach data content. The ransomware gang likewise said its cryptocurrency wallets were emptied and the money was moved to an unidentified account.
Intel 471 acquired a copy of a note from the gang, which mentioned to its affiliates why its public infrastructure was gone, why its servers were inaccessible via SSH, and why its hosting panels were blocked. The gang claimed its hosting company didn’t give any more details except that the inaccessibility of the servers was requested by law enforcement.
The gang mentioned that it is going to release the decryptors for all firms that were attacked yet didn’t pay the ransom; nevertheless, the gang is releasing the decryptors to the affiliates who carried out the ransomware attacks, not to the victim firms. It will be the individual affiliates’ decision if they will give the decryptors to their victims or try to get payment.
Because of the pressure from the U.S. and the lost servers, the affiliate program is shut down, stated the gang.
On the day when that the group’s infrastructure was taken offline, President Biden conducted a press meeting concerning the Colonial Pipeline ransomware attack stating that the government’s efforts to restrict disruption and promising to take action will be counted against the DarkSide ransomware gang.
“We do not think the Russian government had anything to do with this attack, stated President Biden. There is no strong evidence that criminals from Russia did the attack. Biden said that the United States directly communicated with Moscow regarding the command for responsible nations to take action against the ransomware networks. President Biden additionally affirmed that the U.S. Department of Justice has a new task force focused on prosecuting ransomware hackers.
Before the shutdown, the hacking community had begun to avoid the DarkSide group. A top-tier dark web forum utilized by the DarkSide gang to promote its RaaS operations removed the DarkSide account as well as two threads concerning its ransomware operations, as per the Gemini Advisory. Gemini Advisory furthermore remarks to have heard from a number of reputable sources that the group has no more appearance on the dark web. Another top-tier dark web forum frequently employed by ransomware gangs has likewise enforced sanctions on ransomware activities and has blocked them completely from the forum, saying ransomware has turned out to be too toxic.
Intel 471 reports that aside from the DarkSide operations, a number of other ransomware operations also shut down their activities, though it is uncertain if the shutdown will last. Perhaps the ransomware gangs are just want to be inconspicuous and will operate again using another name. The Babuk ransomware operators said that they gave their source code to another gang and won’t do ransomware attacks anymore. They stated their ransomware will be run by another group with a different name.
The REvil ransomware gang also said that it won’t promote its ransomware operations on dark web forums anymore. It wants to make its activities private. REvil and Avaddon have decided to cease their affiliates that attack organizations in specific fields. The two ransomware gangs gave statements about the new rules for affiliates prohibiting them from executing attacks on the federal government, charities, healthcare, and educational organizations in any nation. They furthermore necessitate their affiliates to get approval from the group prior to making any attack. If an affiliate attacks a restricted target, the victim will get the decryptor for free and the affiliate will be completely expelled from the RaaS program.
Intel 471 likewise states that BitMix, a cryptocurrency mixing service utilized by REvil and Avaddon to illegally transfer the cryptocurrency acquired from ransomware attacks was shut down as well.
