Back to Threat Groups
darkside
INACTIVEransomware group
FireEye describes DARKSIDE as a ransomware written in C and configurable to target files whether on fixed, removable disks, or network shares. The malware can be customized by the affiliates to create a build for specific victims.
Victims
10
records
First Discovered
Aug 1, 2020
victim
Last Discovered
May 13, 2021
victim
Inactive Since
1,922
days
Countries
5
hit
Avg Discount
38%
4 settlements
Group Activity
Last 12 monthsSep
2025
Oct
2025
Nov
2025
Dec
2025
Jan
2026
Feb
2026
Mar
2026
Apr
2026
May
2026
Jun
2026
Jul
2026
Aug
2026
Victims (10)
One Call (insurance)
darkside🇬🇧 GB
May 13, 2021
Financial1.0Published
Colonial Pipeline
darkside🇺🇸 US2 groups: raznatovic
May 7, 2021
Transportation Systems1.0Published
colonialpipeline.com
Toshiba Tec Group
darkside
May 1, 2021
Critical Manufacturing1.0Published
Compucom
darkside
Feb 27, 2021
Information Technology1.0Published
Guess
darkside
Feb 1, 2021
Commercial Facilities1.0Published
Home Hardware Stores Ltd
darkside🇨🇦 CA
Feb 1, 2021
Commercial Facilities1.0Published
Discount Car and Truck Rentals
darkside🇨🇦 CA
Feb 1, 2021
Transportation Systems1.0Published
Segafredo Zanetti
darkside🇮🇹 IT
Feb 1, 2021
Food and Agriculture1.0Published
Companhia Paranaense de Energia (Copel)
darkside🇧🇷 BR
Feb 1, 2021
Energy1.0Published
Brookfield Residential (land developer and home builder)
darkside
Aug 1, 2020
Commercial Facilities1.0Published
Infrastructure
leak site
OFFLINE
malformed url
http://darksidedxcftmqa.onion/6d ago
leak site
OFFLINE
unreachable
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/8706ms
6d ago
leak site
OFFLINE
unreachable
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion8566ms
11d ago