⚠️ Overview

DarkRadiation is a Bash-based ransomware strain targeting Linux systems, first publicly documented by Trend Micro researchers in January 2022. Its operators, believed to be a financially motivated threat group, deploy this malware primarily against misconfigured Docker containers and Redis servers. DarkRadiation is classified as ransomware with data exfiltration capabilities, specifically designed to encrypt files and demand payment for decryption keys.

🔧 Technical Capabilities

DarkRadiation spreads by scanning for exposed Docker API endpoints (port 2375/2376) and Redis instances (port 6379) lacking authentication, then uses `curl` and `wget` commands to download the payload onto compromised hosts. The malware is written entirely in Bash, using `openssl` for encryption with a combination of AES-256-CBC and RSA-2048, and embeds a chacha20 variant for additional obfuscation. It communicates with its command-and-control (C2) infrastructure via HTTP POST requests containing host information and encryption status, exfiltrating data before encryption to maximize extortion pressure. Persistence is achieved through cron jobs that re-enable execution if interrupted, while evasion techniques include disabling Linux logging daemons (`syslog`, `rsyslog`) and killing common database and container processes to unlock files. The malware also wipes the Bash history and deletes itself after execution except for the ransom note.

📜 History & Notable Incidents

Trend Micro first observed DarkRadiation in January 2022 during a wave of attacks targeting poorly secured Docker containers on cloud infrastructure. No high-profile victims or specific CVEs have been publicly attributed, but the malware has been linked to wider campaigns against Redis and Docker environments in Asia and Europe. No law enforcement actions or arrests have been reported against the operators as of early 2025.

🔍 Detection Indicators

Network indicators include HTTP POST requests to C2 domains on non-standard ports (e.g., 8080, 8443) with base64-encoded JSON payloads containing fields like `"hostname"`, `"encrypted"`, and `"key"`. File indicators include ransom notes named `README_DARK_RADIATION.txt` and encrypted files appended with `.dark` extension. No static file hashes have been widely published, but YARA rules from Trend Micro detect the Bash script's unique combination of `openssl` and `wget` commands with embedded RSA public keys.

☠️ Risk & Impact

DarkRadiation causes complete file encryption on compromised Linux servers, leading to operational downtime and potential data exfiltration of sensitive business databases. The ransomware primarily affects cloud hosting providers, DevOps environments, and managed services that leave Docker and Redis unauthenticated. Financial impact is moderate per incident but can scale due to automated scanning across IP ranges.

🛡️ Mitigation

Defenders should immediately patch or disable unauthenticated access to Docker daemons (use TLS certificates) and Redis servers (require `requirepass`). Network segmentation and monitoring for outbound HTTP POSTs to unusual ports, combined with endpoint detection rules (e.g., Sigma rules for `openssl` encryption on critical files), are effective. No dedicated decryption tool is publicly available; regular offline backups are the primary recovery strategy.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.