The Krebs Group Ransomware: A Look into DarkSide's Double Extortion Tactics

Ransomware attacks have become increasingly common in recent years, with cybercriminals using various tactics to extort money from victims. One such tactic is double extortion, where attackers demand a separate sum for both a digital key needed to unlock files and servers, as well as a ransom in exchange for the promise of not releasing stolen data. DarkSide, a ransomware-as-a-service platform, has adopted this tactic, seeking to differentiate itself from other competitors.

Launched in 2020, DarkSide initially sought to attract affiliates by promoting its victim data leak site, which receives 'stable visits and media coverage.' The platform also allows partners to publish stolen data in stages. In an effort to avoid social consequences, DarkSide introduced moderation, where it checks each company that its partners want to encrypt.

Unlike other ransomware groups, DarkSide targets only large companies and forbids affiliates from attacking organizations in certain industries, including healthcare, funeral services, education, public sector, and non-profits. The group's goal is to make money without creating problems for society. In an update to its blog, DarkSide emphasized that it is apolitical and does not participate in geopolitics.

The recent Colonial Pipeline attack has garnered significant attention, with some expressing concerns about the potential for widespread infrastructure attacks. However, Flashpoint, a New York City-based cyber intelligence firm, believes that the attack was not intended to damage national infrastructure but rather targeted an organization with sufficient financial means to pay the ransom.

In response to the attack, Colonial Pipeline shut down 5,500 miles of fuel pipe, highlighting the significant disruption caused by ransomware incidents. The DarkSide group's use of double extortion tactics underscores the importance of implementing robust cybersecurity measures and having a plan in place for responding to such attacks.

Krebs group ransomwhere