{ "id": "44d16b98-d01f-47d5-ab13-768a736b551e", "created_at": "2026-04-06T00:20:13.934031Z", "updated_at": "2026-04-10T03:21:23.516719Z", "deleted_at": null, "sha1_hash": "d8c76b0faf635e2860f22c6668c0f73c6552730e", "title": "DarkSide ransomware is creating a secure data leak service in Iran", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1269865, "plain_text": "DarkSide ransomware is creating a secure data leak service in Iran\r\nBy Lawrence Abrams\r\nPublished: 2020-11-13 · Archived: 2026-04-05 21:20:00 UTC\r\nThe DarkSide Ransomware operation claims they are creating a distributed storage system in Iran to store and leak data\r\nstolen from victims. To show they mean business, the ransomware gang has deposited $320 thousand on a hacker forum.\r\nDarkSide is run as a Ransomware-as-a-Service (RaaS) where developers are in charge of programming the ransomware\r\nsoftware and payment site, and affiliates are recruited to hack businesses and encrypt their devices.\r\nAs part of this arrangement, the DarkSide ransomware developers receive a 10-25% cut, and an affiliate gets 75-90% of any\r\nransom payments they generate.\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/\r\nPage 1 of 5\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/\r\nPage 2 of 5\n\nVisit Advertiser websiteGO TO PAGE\r\nAs DarkSide is a private operation, hackers who want to distribute their ransomware must first apply for access.\r\nDistributed storage system to leak data\r\nYesterday, cybersecurity intelligence firm Kela shared a new topic posted by the DarkSide Ransomware operators on a\r\nRussian-speaking hacker forum with BleepingComputer.\r\nIn this topic, DarkSide has stated that they are working on a distributed storage system to store and leak victims' stolen data.\r\nSince late 2019, ransomware operations have been actively performing a double-extortion strategy of stealing unencrypted\r\ndata and then encrypting the victim's computers. The encrypted files and the threat to publicly release data on ransomware\r\ndata leak sites are used to extort victims into paying the ransom.\r\nTo disrupt these extortion demands, law enforcement and cybersecurity firms actively try to take down these data leak sites.\r\nTo prevent this, DarkSide states that they plan to create a distributed \"sustainable storage system\" in Iran to host the victim's\r\nstolen data for six months.\r\n\"Some targets think that if a lot of data has been downloaded from them, then after their publication, hackers and other\r\npeople will download it for a long time through the TOR. We think so too, so we will change it.\"\r\n\"We are already working on a sustainable storage system for your data. All your data will be replicated between multiple\r\nservers, blocking one server won't delete data.\"\r\n\"Those companies that have already been published will be uploaded there, their data will be guaranteed to be stored for 6\r\nmonths. So you can download their data much faster.\"\r\n\"We will specifically use servers in Iran or unrecognized republics so that you cannot block them, and an automatic system\r\nwill determine the availability and give you a suitable download link,\" the DarkSide operators stated.\r\nThey state that all the stolen data will be replicated between the various servers, so if one server is taken down, the data\r\ncould still be accessed from the others.\r\nDarkSide deposits $320 thousand on a hacker forum\r\nAs part of this same forum topic, the DarkSide operation announced that they were looking for new Russian affiliates to join\r\ntheir program, who they claim to earn an average of $400k per victim.\r\nAs part of this recruitment drive, affiliates must pass an interview and answer any questions the developers have about their\r\nlevel of experience.\r\n\"Pass an interview, show your work and payments, answer the necessary questions.\" - DarkSide developers.\r\nUnlike other ransomware operations, such as Ryuk, Egregor, and others,  DarkSide states that do not allow attacks on:\r\nMedicine (hospitals, hospices).\r\nEducation (schools, universities).\r\nNon-profit organizations.\r\nGovernment sector.\r\nIt is too soon to tell if DarkSide will keep its promises about not targeting these organizations.\r\nIn addition to recruiting affiliates, DarkSide states that they are willing to spend 400K to hackers with access to large\r\ncompanies in the USA that can be encrypted.\r\nTo back up their claims, the DarkSide gang deposited 20 bitcoins on the forum, which is worth approximately $320\r\nthousand at today's values.\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/\r\nPage 3 of 5\n\nDeposit of 20 bitcoins\r\nAs you can see below, the public-facing representative of DarkSide, known as 'darksupp', now has 20 bitcoins deposited in\r\ntheir account.\r\n20 bitcoin deposit\r\nThese deposited bitcoins can then be transferred to other members to purchase software, services, or information.\r\nThis show of wealth is similar to REvil's recruitment drive in September when they deposited $1 million in bitcoins to the\r\nsame forum.\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/\r\nPage 4 of 5\n\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/\r\nhttps://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/\r\nPage 5 of 5", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.bleepingcomputer.com/news/security/darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran/" ], "report_names": [ "darkside-ransomware-is-creating-a-secure-data-leak-service-in-iran" ], "threat_actors": [], "ts_created_at": 1775434813, "ts_updated_at": 1775791283, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/d8c76b0faf635e2860f22c6668c0f73c6552730e.pdf", "text": "https://archive.orkl.eu/d8c76b0faf635e2860f22c6668c0f73c6552730e.txt", "img": "https://archive.orkl.eu/d8c76b0faf635e2860f22c6668c0f73c6552730e.jpg" } }