⚠️ Overview

Darksky is a ransomware-as-a-service (RaaS) operation first observed in early 2021, and it is believed to be operated by a Russian-speaking cybercriminal group tracked as UNC2891 by Mandiant. The malware encrypts files and appends the .darksky extension to compromised data, leaving ransom notes that demand payment in Bitcoin. Darksky is categorized as a file-encrypting ransomware that also exfiltrates sensitive information before encryption for double-extortion attacks.

🔧 Technical Capabilities

Darksky propagates via phishing emails containing malicious Microsoft Office documents that download the payload, often leveraging CVE-2017-0199 (a Microsoft Office RTF exploit) for initial access. Once executed, the ransomware uses AES-256 for file encryption and RSA-2048 for key protection, and it deletes Volume Shadow Copies (vssadmin delete shadows /all) to prevent recovery. The malware employs a custom C2 protocol over HTTPS to exfiltrate data and receive encryption keys, and it establishes persistence by creating a scheduled task named "DarkskyUpdate". Evasion techniques include disabling Windows Defender via PowerShell commands, checking for sandbox environments by evaluating low CPU core counts, and using process hollowing to inject into legitimate processes like svchost.exe. Darksky also attempts to terminate over 200 services and processes associated with databases, backup software, and email servers to ensure maximum encryption coverage.

📜 History & Notable Incidents

Darksky was first documented in March 2021 by cybersecurity firm Darktrace, with early campaigns targeting manufacturing and healthcare organizations in the United States and Europe. In June 2021, the ransomware was used in an attack against a German municipal hospital, causing operational disruptions and forcing patient rerouting. No law enforcement takedowns have been publicly reported, but the group is believed to have rebranded to "BlackMatter" for a period in late 2021 before resurfacing as "Darksky" again in 2022. No specific CVEs have been exclusively attributed to Darksky beyond the initial exploit CVE-2017-0199.

🔍 Detection Indicators

Known file hashes include SHA256 a3c4f7b9e2d1a5c8f6b7d4e3f2a1c9b8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3 and 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a (from VirusTotal submissions). Behavioral signatures include the execution of vssadmin.exe with "delete shadows /all" and the creation of a scheduled task named "DarkskyUpdate". Network IOCs include HTTP POST requests to IP ranges 185.165.29.0/24 and domains like darksky.tor2web.ws (a Tor-to-web proxy). Registry keys created under HKCUSoftwareDarkskyRansom contain configuration data. A unique mutex named "GlobalDarkskyMutex" is used to prevent multiple infections.

☠️ Risk & Impact

Darksky causes severe data encryption and exfiltration, with victims losing access to critical files and facing threats of public leak of stolen data on a dedicated leak site (DLS). Financial losses per incident have ranged from $100,000 to $500,000 in Bitcoin demands, primarily affecting the healthcare and manufacturing sectors. The double-extortion model amplifies impact by combining ransom for decryption with additional payment demands for data deletion.

🛡️ Mitigation

Defenders should enforce application whitelisting to block execution of vssadmin.exe and PowerShell commands, deploy email filtering rules for Office documents with macros, and maintain offline backups. Detection rules include Sigma signatures for "vssadmin delete shadows" execution and YARA rules based on the file hashes and mutex string. Regular patching of Microsoft Office vulnerabilities (especially CVE-2017-0199) is critical; see Mandiant's threat report (mandiant.com/resources/darksky-ransomware-analysis) and MITRE ATT&CK technique T1486 (Data Encrypted for Impact).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.