What is the DarkBit Ransomware?
While investigating new malware strains, our team came across DarkBit - a ransomware that operates by encrypting data and demanding ransoms for decryption. Upon launching a sample of DarkBit, it immediately begins encrypting files and renaming them with a random character string and the ".Darkbit" extension.
Once the encryption process was complete, DarkBit created a ransom note named "RECOVERY_DARKBIT.txt" and left it on the desktop. Unlike other ransom notes, DarkBit's message began with a political rant, which implies that the ransomware was intended to target large entities like companies instead of home users.
According to the ransom note, the files were encrypted using the AES-256 cryptographic algorithm, and sensitive data was exfiltrated. The note warns victims against using third-party recovery tools or services, which may result in permanent data loss.
The attackers demand a ransom of 80 BTC (Bitcoin cryptocurrency) for the decryption keys/tools, which is equivalent to approximately 1.7 million USD (depending on exchange rates). The ransom amount is indicative that the ransomware is typically not leveraged against home users. The note also indicates that if no action is taken within 48 hours, the ransom amount will increase by 30%, and five days later, the attackers will put the stolen data up for sale.
The DarkBit Ransom Note Gets Political
The complete text of the "RECOVERY_DARKBIT.txt" file that contains the ransom note goes as follows:
Dear Colleagues,
We’re sorry to inform you that we’ve had to hack Technion network completely and transfer “all” data to our secure servers.
So, keep calm, take a breath and think about an apartheid regime that causes troubles here and there.
They should pay for their lies and crimes, their names and shames. They should pay for occupation, war crimes against humanity,
killing the people (not only Palestinians’ bodies, but also Israelis’ souls) and destroying the future and all dreams we had.
They should pay for firing high-skilled experts.Anyway, there is nothing for you (as an individual) to be worried.
That’s the task of the administration to follow up our instruction for recovering the network.
But, you can contact us via TOX messenger if you want to recover your files personally. (TOX ID: AB33BC51AFAC64D98226826E70B483593C81CB22E6A3B504F7A75348C38C862F00042F5245AC)Our instruction for the administration:
All your files are encrypted using AES-256 military grade algorithm. So,
- Don't try to recover data, because the encrypted files are unrecoverable unless you have the key.
Any try for recovering data without the key (using third-party applications/companies) causes PERMANENT damage. Take it serious.- You have to trust us. This is our business (after firing from high-tech companies) and the reputation is all we have.
- All you need to do is following up the payment procedure and then you will receive decrypting key using for returning all of your files and VMs.
- Payment method:
Enter the link below
hxxp://iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion/supportEnter the ID below and pay the bill (80 BTC)
You will receive decrypting key after the payment.
Notice that you just have 48 hours. After the deadline, a 30% penalty will be added to the price.
We put data for sale after 5 days.
Take it serious and don’t listen to probable advices of a stupid government.Good Luck!
DarkBit
Why Do Some Ransomware Variants Like DarkBit Choose to Target Companies Over Home Users?
According to the ransom note left by DarkBit, it seems to target large entities like companies rather than home users. While the exact motivations of ransomware authors may vary, one possible reason for targeting companies is the potential for larger payouts. Companies may have more valuable or sensitive data than individual users, and they may be willing to pay a larger ransom to avoid the disruption and potential legal liability that could result from a data breach. Additionally, companies may have less robust security measures in place compared to home users, making them more vulnerable to attacks. However, it's important to note that any organization or individual can be a target of a ransomware attack, regardless of their size or industry.
