Dharma

Dharma is a ransomware family, commonly referenced as a ransomware-as-a-service (RaaS) variant and frequently discussed alongside Phobos due to their similarity and shared affiliate-style ecosystem. The provided content places Dharma among long-running ransomware families that remained active or widely observed through at least 2021–2023, and notes that affiliates often move between multiple RaaS programs rather than remaining loyal to one brand. Reporting cited in the content also links some activity around 8base to former Dharma and Phobos affiliates.

Operationally, the content associates Dharma with campaigns that begin through phishing emails or compromised credentials. It is characterized as affecting smaller organizations in some reporting, including “spray and pray” style attacks and attacks against small companies with exposed RDP, while other reporting notes its presence among top ransomware variants observed in incident-response datasets. The content also states Dharma was among variants associated with re-extortion, where victims may be pressured for additional payment after an initial ransom.

A recurring theme in the source material is Dharma operators’ abuse of legitimate, often digitally signed administrative or troubleshooting tools to disable defenses before ransomware deployment. Tools explicitly mentioned in Dharma-linked campaigns include IOBit Unlocker, Process Hacker, PowerRun, YDArk, Mimikatz, and Unlock_IT. According to the cited reporting, these tools were used to kill antivirus or EDR processes, gain SYSTEM- or kernel-level access, steal credentials, and erase logs or forensic traces. More generally, the content ties Dharma to defense-impairment behavior such as abusing legitimate rootkit-removal kits and low-level tools to disable security products.

The content also includes ecosystem and law-enforcement context. Ukraine’s Cyber Police reportedly detained suspects in November 2022 in connection with LockerGoga, MegaCortex, Hive, and Dharma ransomware attacks, and later investigations and arrests in Ukraine were again described as involving the Dharma ransomware family. Financial reporting cited in the content includes Dharma in ransomware payment analyses, with one Chainalysis dataset characterizing Dharma as a low-level RaaS strain used against smaller targets and listing very small average and median payment sizes. Only high-confidence information directly stated in the content is included here.