Dharma

Color by numbers: inside a Dharma ransomware-as-a-service attack | SOPHOS

Sophos reported that the Dharma ransomware operation, also known as CrySis, continues to profit as a ransomware-as-a-service scheme by targeting small and medium-sized businesses through high-volume intrusions. Investigators said many attacks begin with compromised or poorly secured Remote Desktop Protocol (RDP) access, often using stolen credentials purchased on criminal forums, before affiliates move deeper into victim networks and deploy the ransomware payload. The operation relies on a standardized affiliate toolkit built around a menu-driven PowerShell script, toolbelt.ps1, that automates much of the attack chain for low-skill operators. Sophos said the toolkit combines Windows utilities, legitimate freeware, public exploits, and custom scripts for credential theft with Mimikatz, reconnaissance, Active Directory discovery, lateral movement, antivirus disruption, Tor-based communications, and final encryption, while a two-stage decryption process keeps affiliates dependent on core operators for key retrieval and victim support.

Dharma (CrySiS) Ransomware: Technical Analysis, Context and Mitigation

Paradise Ransomware Distributed Through AweSun Vulnerability Exploitation - ASEC

The Paradise ransomware operation, a long-running ransomware-as-a-service family first seen in 2017, drew renewed concern after the source code for its .NET variant was leaked on the Russian-speaking XSS forum. Researchers said the leak included the Paradise builder and a decryption utility, and analysts verified the files as authentic. Although the .NET branch had seen more limited use than the native Paradise version, newly built samples were reportedly being classified as undecryptable, raising the risk that additional threat actors could repurpose the code against home users and small businesses. Subsequent intrusions showed Paradise being deployed through suspected exploitation of outdated AweSun remote-control software, alongside activity involving Sunlogin flaws, Sliver C2, Cobalt Strike, BYOVD tooling, and XMRig. In one analyzed case, the ransomware used RSA-1024 encryption, deleted Volume Shadow Copies, set persistence through a Windows Run key, prioritized database and backup paths for encryption, and sent victim metadata to a command-and-control endpoint before dropping a ransom note tied to the email main@paradisenewgenshinimpact.top and a Bitcoin wallet. Defenders were urged to patch exposed remote-access software and maintain endpoint protections to reduce the risk of Paradise deployment.

Source code for Paradise ransomware leaked on hacking forums | The Record from Recorded Future News

Threat Assessment: Matrix Ransomware

Matrix ransomware has targeted small- to medium-sized organizations in multiple countries since its public emergence in 2016, with its delivery methods shifting over time from spam emails, malicious Windows shortcut files, and the RIG exploit kit to the brute forcing of weak Remote Desktop Protocol (RDP) credentials. The campaign reflects a broader move toward targeted ransomware intrusions that rely on exposed remote access services rather than mass distribution alone. Once launched, Matrix encrypts local files and network shares, deletes volume shadow copies, disables recovery options, and demands payment in Bitcoin. Operators use a variable ransom model in which victims are told to make contact and provide sample files for decryption so the attackers can assess payment demands; known variants use multiple file extensions, including the Fox strain that appends .FOX to encrypted files.

If it sounds too good to be true, it most likely is: Nobody can decrypt the Dharma ransomware

Security researchers said companies claiming to decrypt files locked by Dharma/Crisis ransomware are not defeating the malware’s encryption, which experts described as effectively unbreakable without a flaw or the criminals’ private key. An investigation by Emsisoft and outside researchers challenged Australian firm Fast Data Recovery after it advertised a high chance of recovering Dharma-encrypted files and claimed it could reverse engineer decryption keys, despite specialists including Brett Callow, Michael Gillespie, Bill Siegel, and Fabian Wosar saying no such capability is known to exist. Separate research by Check Point found that Russian service Dr. Shifro allegedly operated as a broker between victims and ransomware operators, buying decryption keys at a discount and reselling recovery at a markup rather than performing true cryptographic recovery. In a sting operation, Check Point observed the service requesting encrypted samples and then contacting the attacker-side email to negotiate key purchases; the researchers linked the activity to iharauch@gmail.com and identified a likely operator in Moscow, estimating profits of about $1,350 per victim and potentially hundreds of thousands of dollars overall.

The Ransomware Doctor Without a Cure - Check Point Research