Description Summary
Ransomware-as-a-Service
Threat Actor
DarkSide successor RaaS; bought access from initial-access brokers targeting 500–15,000-host enterprises.
Technical Indicators
Encryption Extension
.<random>
Encryption Algorithm
Salsa20 (files) + RSA-1024 (key wrapping); partial encryption
Ransom Note Name
[random].README.txt
Targeted Industries
Agriculture, Manufacturing, Critical infrastructure
First Seen
July 2021
Last Seen
November 2021 (shut down; operators → ALPHV/BlackCat)
Geographical Location
United States, Europe
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |