{ "id": "62edf1ba-4ce6-4f4f-9b62-2f1d9b779a58", "created_at": "2026-04-06T00:07:05.51504Z", "updated_at": "2026-04-10T03:20:51.979633Z", "deleted_at": null, "sha1_hash": "4dba2185f39c653c4e1282796a13bbd7edec81ab", "title": "DarkSide ransomware servers reportedly seized, operation shuts down", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1432719, "plain_text": "DarkSide ransomware servers reportedly seized, operation shuts down\r\nBy Lawrence Abrams\r\nPublished: 2021-05-14 · Archived: 2026-04-05 19:42:13 UTC\r\nThe DarkSide ransomware operation has allegedly shut down after the threat actors lost access to servers and their\r\ncryptocurrency was transferred to an unknown wallet.\r\nThis news was shared by a threat actor known as 'UNKN', the public-facing representative of the rival REvil ransomware\r\ngang, in a forum post first discovered by Recorded Future researcher Dmitry Smilyanets on the Exploit hacking forum.\r\nIn the post, 'Unkn' shared a message allegedly from DarkSide explaining how the threat actors lost access to their public data\r\nleak site, payment servers, and CDN servers due to law enforcement action.\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/\r\nPage 1 of 6\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/\r\nPage 2 of 6\n\nVisit Advertiser websiteGO TO PAGE\r\n\"Since the first version, we have promised to speak honestly and openly about problems. A few hours ago, we lost access to\r\nthe public part of our infrastructure, namely : Blog, Payment server, DOS servers,\" reads the forum post from UNKN.\r\n\"Now these servers are unavailable via SSH, the hosting panels are blocked. Hosting support, apart from information \"at the\r\nrequest of law enfocement agencies\", does not provide any other information.\"\r\nThis news comes a day after President Biden said in a White House press conference that countries harboring ransomware\r\nnetworks must take action to shut them down.\r\n\"We do not believe — I emphasize, we do not believe the Russian government was involved in this attack.  But we do have\r\nstrong reason to believe that criminals who did the attack are living in Russia.  That’s where it came from — were from\r\nRussia,\"  Biden said in a press conference about the Colonial Pipeline attack.\r\n  \"We have been in direct communication with Moscow about the imperative for responsible countries to take decisive\r\naction against these ransomware networks.\"\r\nStarting yesterday, security researchers and journalists noted that the DarkSide data leak site was no longer accessible, and it\r\nwas speculated that law enforcement had seized the server.\r\nOffline DarkSide data leak site\r\nHowever, BleepingComputer has confirmed that the DarkSide Tor payment server is still operational at the time of this\r\nwriting. If law enforcement seized the server, they might have kept it running to allow victims to access their decryptors.\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/\r\nPage 3 of 6\n\nDarkSide Tor payment live at the time of writing\r\nFeeling the heat from law enforcement, it has also been speculated that the DarkSide ransomware gang may be pulling an\r\nexit scam.\r\nAfter pulling in $9.4 million in ransom payments this week between Brenntag and Colonial Pipeline, they may be stealing\r\nthe money, so they do not have to pay affiliates and to blame it on a law enforcement operation.\r\nDarkSide shuts down affiliate program\r\nAfter we published our story, Intel471 gained access to the full message sent to affiliates of the DarkSide ransomware-as-a-service operation.\r\nAccording to this message, DarkSide decided to close their operation \"due to the pressure from the US\" and after losing\r\naccess to their public-facing servers.\r\nThe full translated message acquired by Intel471 is below:\r\nStarting from version one, we promised to speak about problems honestly and openly. A couple of hours ago, we\r\nlost access to the public part of our infrastructure, in particular to the\r\nblog\r\npayment server\r\nCDN servers\r\nAt the moment, these servers cannot be accessed via SSH, and the hosting panels have been blocked.\r\nThe hosting support service doesn't provide any information except \"at the request of law enforcement\r\nauthorities.\" In addition, a couple of hours after the seizure, funds from the payment server (belonging to us and\r\nour clients) were withdrawn to an unknown account.\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/\r\nPage 4 of 6\n\nThe following actions will be taken to solve the current issue: You will be given decryption tools for all the\r\ncompanies that haven't paid yet.\r\nAfter that, you will be free to communicate with them wherever you want in any way you want. Contact the\r\nsupport service. We will withdraw the deposit to resolve the issues with all the affected users.\r\nThe approximate date of compensation is May 23 (due to the fact that the deposit is to be put on hold for 10 days\r\non XSS).\r\nIn view of the above and due to the pressure from the US, the affiliate program is closed. Stay safe and good luck.\r\nThe landing page, servers, and other resources will be taken down within 48 hours.\r\nAn interesting point in this message is that the affiliates will be provided decryptors for their victims. These decryptors will\r\nallow the affiliates to extort those victims on their own without any affiliation with DarkSide.\r\nREvil ransomware adds new restrictions\r\nHistorically, the REvil ransomware gang has shown no scruples regarding who they attack.\r\nHowever, after the DarkSide's reported takedown, REvil has now begun to impose new restrictions on who can be\r\nencrypted.\r\nREvil's representative, UNKN, states that affiliates are now required first to gain permission to target an organization and\r\nthat they can no longer target the following entities:\r\n1. Work in the social sector (health care, educational institutions) is prohibited;\r\n2. It is forbidden to work on the gov-sector (state) of any country;\r\nRansomware-as-a-Service (RaaS) operations have historically run as a free-for-all, where affiliates encrypt any victim they\r\nwant without gaining prior approval.\r\nIt will be interesting to see if these new rules will lead affiliates to move to other RaaS operations with fewer restrictions.\r\nUpdate 5/14/21: Added full message sent to affiliates about DarkSide closing down. Changed DoS to CDN (thx Evgueni).\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/\r\nPage 5 of 6\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/\r\nPage 6 of 6", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.bleepingcomputer.com/news/security/darkside-ransomware-servers-reportedly-seized-revil-restricts-targets/" ], "report_names": [ "darkside-ransomware-servers-reportedly-seized-revil-restricts-targets" ], "threat_actors": [], "ts_created_at": 1775434025, "ts_updated_at": 1775791251, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/4dba2185f39c653c4e1282796a13bbd7edec81ab.pdf", "text": "https://archive.orkl.eu/4dba2185f39c653c4e1282796a13bbd7edec81ab.txt", "img": "https://archive.orkl.eu/4dba2185f39c653c4e1282796a13bbd7edec81ab.jpg" } }