{
	"id": "1ec9c496-eda0-4a31-b78f-a5317de28b0e",
	"created_at": "2026-04-06T00:14:35.371312Z",
	"updated_at": "2026-04-10T13:12:59.436586Z",
	"deleted_at": null,
	"sha1_hash": "3cb910317d5cfef4d4f5ae9e8ef2c0077cfba386",
	"title": "Darkside gang estimated to have made over $90 million from ransomware attacks",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 155715,
	"plain_text": "Darkside gang estimated to have made over $90 million from\r\nransomware attacks\r\nBy Catalin Cimpanu\r\nPublished: 2022-12-21 · Archived: 2026-04-05 20:02:10 UTC\r\nThe operators of the Darkside ransomware are believed to have made at least $90 million from ransom payments\r\nover the past nine months, since October 2020.\r\n\"In total, just over $90 million in Bitcoin ransom payments were made to DarkSide, originating from 47 distinct\r\nwallets,\" blockchain analysis firm Elliptic said in a report published earlier today.\r\nCiting data shared by dark web intelligence platform DarkTrace, Elliptic said the Darkside group appears to have\r\nmade at least 99 victims, of which approximately 47% paid their ransom demands.\r\n\"The average payment was $1.9 million,\" said Elliptic co-founder and chief scientist Dr. Tom Robinson.\r\n\"May was set to be a record month, until DarkSide reportedly shut down its operations on May 13, and its Bitcoin\r\nwallet was emptied.\"\r\nElliptic's report comes after previous studies have put the estimated earnings of gangs like Maze/Egregor at $75\r\nmillion, Ryuk at $150 million, REvil at $100 million (threat actor's own claims), and Netwalker at $25 million (for\r\na period of 3 months only).\r\nWhile estimating a ransomware gang's earnings is not an exact science, as investigators never have a full picture\r\nof a gang's operations, Elliptic's findings firmly put the Darkside group in the upper echelon of ransomware\r\nhttps://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/\r\nPage 1 of 3\n\noperations.\r\nSince Darkside is provided through a ransomware-as-a-service (RaaS) model, which allows the Darkside coders to\r\nkeep 25% of the paid ransoms, or 10% if the ransom is larger than $5 million, Elliptic believes that the actual\r\nDarkside group made roughly $15.5 million, while the rest of the funds were transferred to Darkside's affiliates\r\n—the group who rented the ransomware and then deployed it inside the hacked companies.\r\nBot knowing how much money a ransomware gang made is a rather useless stat that does nothing but promotes\r\nthe profitability of the ransomware criminal ecosystem.\r\nIn an email today, Dr. Robinson told The Record that they weren't only able to estimate the group's earnings, but\r\nthey were also able to track down how the Darkside payments moved across the blockchain to cash-out points,\r\ninformation which the Elliptic exec said is available to the law enforcement agencies that use its platform and\r\n\"which provides investigators with important leads.\"\r\nNo previous article\r\nNo new articles\r\nhttps://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/\r\nPage 2 of 3\n\nCatalin Cimpanu\r\nis a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement\r\nactions against hackers.\r\nSource: https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/\r\nhttps://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://therecord.media/darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks/"
	],
	"report_names": [
		"darkside-gang-estimated-to-have-made-over-90-million-from-ransomware-attacks"
	],
	"threat_actors": [],
	"ts_created_at": 1775434475,
	"ts_updated_at": 1775826779,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3cb910317d5cfef4d4f5ae9e8ef2c0077cfba386.pdf",
		"text": "https://archive.orkl.eu/3cb910317d5cfef4d4f5ae9e8ef2c0077cfba386.txt",
		"img": "https://archive.orkl.eu/3cb910317d5cfef4d4f5ae9e8ef2c0077cfba386.jpg"
	}
}