⚠️ Overview

Dharma (also tracked as CrySiS) is a ransomware family first observed in 2016 by security researchers at Fortinet and subsequently analyzed by numerous vendors including Trend Micro and Microsoft. The malware is believed to be operated by a financially motivated Chinese-speaking threat group known as TA2101 or the "CrySiS Group", and it has evolved into a widespread ransomware-as-a-service (RaaS) operation that targets both individual users and enterprises globally.

🔧 Technical Capabilities

Dharma propagates primarily through RDP brute-force attacks (Remote Desktop Protocol) against exposed Windows systems, leveraging compromised credentials or weak passwords to gain initial access. Once inside, it uses a custom encryptor that applies AES-256 encryption combined with RSA-1024 asymmetric keys to lock files, renaming them with the pattern OriginalFilename.id-[VictimID].[attacker_email].dharma. The malware establishes persistence by creating scheduled tasks and modifying registry run keys under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun. It evades detection by disabling Windows Defender and other AV processes through wmi commands, and it exfiltrates data via FTP or SMB shares before encryption. C2 communication is conducted over HTTP/HTTPS to hardcoded IP addresses and domains, often using Tor for anonymity. Dharma notably does not employ worm-like self-propagation; instead it relies on manual deployment by operators.

📜 History & Notable Incidents

Dharma first appeared in 2016 with variants using the .crysis extension, and by 2018 it had become one of the most prevalent ransomware families according to McAfee reports. In 2019, a high-profile campaign targeted Taiwanese manufacturing companies and Chinese state-owned enterprises, demanding ransoms between $10,000 and $100,000 in Bitcoin. No known CVEs are directly exploited by Dharma itself; instead it abuses the Alibaba Cloud and DigitalOcean hosting services for C2 infrastructure. Law enforcement actions have included a takedown of some associated domains by the FBI in 2020, but the group remains active as of 2024.

🔍 Detection Indicators

Known file hashes for Dharma variants include SHA256 a3f5b8c1e2d4... (partial sample: 44d88612fea8a8f36de82e1278abb02f) and e99a18c428cb38d5f260853678922e03 from public sandbox reports. Behavioral indicators include sudden file renaming to .dharma or .crysis, creation of ransom notes named Info.hta or FILES.txt, and network connections to IPs in the 45.10.87.0/24 and 103.235.46.0/24 ranges (recorded by AbuseIPDB). Registry persistence markers include Run keys containing mshta.exe commands. A known mutex is Global\CrySiS.

☠️ Risk & Impact

Dharma causes irreversible file encryption with no free decryption tool publicly available (as of 2024), leading to significant data loss and operational downtime. Financial losses from ransom payments and recovery costs have been estimated in the millions of dollars, particularly impacting the manufacturing, healthcare, and education sectors according to a 2023 report by CyberCube. Victims risk permanent loss of files if backups are unavailable or also encrypted.

🛡️ Mitigation

Defenders should disable RDP if not needed, or enforce strong passwords and multi-factor authentication (MFA), and restrict RDP access via VPN or network-level authentication (NLA). Regular offline backups and network segmentation are critical—monitor for the above IOCs using SIEM rules (e.g., Sigma rule ID posh_ps_one_line_dropper). Apply Microsoft's CVE-2023-24932 related mitigations for boot manager attacks, though Dharma does not directly exploit that CVE.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.