DarkSide

Internal ID: elf.darkside

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying elf.darkside. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

DarkSide is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://abcnews.go.com/Politics/biden-speak-colonial-pipeline-attack-americans-face-gasoline/story?id=77666212

→https://blog.gigamon.com/2021/05/17/tracking-darkside-and-ransomware-the-network-view/

→https://blog.group-ib.com/blackmatter#

→https://blog.group-ib.com/blackmatter2

→https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service

→https://blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html

→https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise

→https://cybersecurity.att.com/blogs/labs-research/darkside-raas-in-linux-version

→https://krebsonsecurity.com/2021/05/darkside-ransomware-gang-quits-after-servers-bitcoin-stash-seized/

→https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

elf.darkside

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search DarkSide