Discovery of New Ransomware Variant - DarkWorld

Description

The FortiEDR team has discovered a new ransomware variant named DarkWorld. FortiGuard Labs has confirmed this ransomware is written in .NET. and gets its name from its filename DarkWorld.exe. The ransomware spawns 10 encryption threads and uses the Rijndael encryption algorithm (AES) to lock victim files. Static analysis reveals that DarkWorld will encrypt files and communicate with a C2 server, most likely for further instruction. DarkWorld also contains anti-analysis techniques, and will detect if a debugger is present.

Further analysis reveals that the ransomware will contact a URL that is the command and control server that resides on a free web hosting service based in the United States. Querying historical data, this webhosting service has had numerous threat actors abuse its services in the past due to it being a free service. Because of this, it is very likely that none of the previous attacks emanating from the same IP address is the same threat actor.

Our datasets show a spike in activity during the last period of December 2020 to present. The highest activity of countries visiting this IP address during this time came from India (58%), then followed by Colombia (15%), France (15%), Chile (6%) and The United States (6%).

What Operating Systems are Affected?

Windows based operating systems.

How Serious of an Issue is This?

MEDIUM. This is rated medium as we have not seen other instances of this ransomware elsewhere and spread appears to be low for the time being. This rating will be revised if we see observe further occurrences of DarkWorld in the wild.

Should Victims Pay the Ransom?

FortiGuard Labs cannot provide any guidance here. It is up to each organization to determine their risk. Factors in that decision include determining the potential for loss due to downtime and reputation, along with whether or not an organization has cybersecurity insurance coverage to help mitigate such potential losses.

What is the Status of Coverage?

FortiGuard Labs has the following AV coverage in place for DarkWorld Ransomware

[SHA256: f263491136e9c874f6fc53d1e060ba94f2c28dac7187665abb9d7f24ea3bc364] in place as:

Malicious_Behavior.SB

For FortiEDR protections, all published IOC's were added to our Cloud intelligence and will be blocked if executed on customer systems.

All Network IOC's related to this threat are blocked by the FortiGuard WebFiltering Client.

Any Other Suggested Mitigation?

Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.

Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.