The emerging DarkMatter Ransomware-as-a-Service (RaaS) platform targets enterprise cloud and on-premises environments with polymorphic lockers. This technical advisory details its multi-platform execution, evasion tactics, and enterprise containment strategies.
Exploiting vulnerable edge infrastructure, purchasing active sessions from IABs, or phishing.
Executing 7 distinct UAC bypasses; patching ETW/AMSI and checking for virtual sandbox environments (VMware, VirtualBox).
Dumping LSASS memory, token impersonation, and mapping domains to propagate payloads via PsExec/GPO.
Staging and exfiltrating target directories using utilities like Rclone or MEGASync.
Deleting Shadow Copies (VSS), killing open files via Restart Manager, and initiating optimized multithreaded encryption.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
June 27, 2026
The Redact ransomware group, an extortion-only offshoot linked to UNC6671, has targeted FCCI Insurance Group, stealing 145 GB of corporate data. The group bypassed multi-factor authentication by utilizing advanced voice phishing (vishing) and session hijacking to execute automated cloud-to-cloud data extraction.
ANUBIS ransomware has targeted Quest Health Solutions, exfiltrating 239 GB of sensitive operational data. Operating under a dual-threat encryption and wiping model, this Go-based malware poses severe risks to healthcare infrastructure. Explore the technical attack chain, SIEM detection rules, and containment steps.
June 19, 2026
Legal firm Vogeler Rechtsanwälte has been targeted by the Cloak ransomware group, with attackers claiming possession of 1.1 TB of organizational data. We analyze the implications of this incident and how firms can protect against high-stakes exfiltration threats.
Enterprise cloud infrastructure, virtualized hosts, and on-premises domain networks are the primary targets of a highly structured cybercriminal collective operating a new Ransomware-as-a-Service (RaaS) platform called DarkMatter. Seeking maximum operational impact and high financial payouts, this group explicitly targets small, medium, and large enterprise environments while excluding low-profit entities. The development showcases a sophisticated multi-platform payload builder designed to compromise diverse architectures, from legacy Windows active directory setups to modern cloud containers.
The platform, which is closely linked to the ODDSIDE ransomware family, operates with strict discipline under a franchise model. Threat operators lease the builder to Russian-speaking affiliates, offering them extensive operational support, custom lockers, dedicated Tor negotiation panels, and real-time callback reporting. In order to evade regional law enforcement, the operators maintain a strict policy against attacking entities within the Commonwealth of Independent States (CIS) and healthcare organizations. However, for organizations in the GCC region, the threat represents a critical escalation in multi-platform cyber extortion.
To defend against DarkMatter, enterprise security teams must understand the exact mechanics of its deployment. The payload deployment lifecycle proceeds through structured phases, from initial perimeter compromise to domain-wide cryptographic impact.
A successful DarkMatter compromise leads to catastrophic operational disruption. Beyond simple file locking, the threat group utilizes double-extortion tactics, extracting sensitive corporate data through a dedicated exfiltration tool before initiating the encryption process. This sensitive data is subsequently published on their onion-hosted leak site if negotiations break down.
For organizations operating under strict compliance frameworks like PCI-DSS or SOC 2, a breach of this magnitude translates to immediate regulatory exposure, massive financial fines, and long-term reputation loss. Because the affiliates actively steal domain credentials and session cookies during the initial stages, the risk of persistent access remains high even after restoring systems from backups. If your domain or credentials have been compromised in past breaches, threat actors could use that information as an entry point. Free domain exposure scan: Use FemtoSec's Dark Web Scanner to check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
To reduce the risk of a devastating ransomware incident, enterprises should transition from passive monitoring to an active offensive posture. Regular Penetration Testing is critical to identify vulnerability exposure points, privilege escalation pathways, and gaps in network segmentation before ransomware actors can exploit them.
Furthermore, security leaders must enforce strict access controls. Implement multi-factor authentication (MFA) across all external services, restrict remote access to authorized virtual desktops, isolate critical backups in an offline or immutable vault, and conduct continuous security awareness training to educate users against social engineering lures.
Affiliates typically secure initial entry through a mix of stolen credentials, session hijacking, or exploiting public-facing software. Publicly exposed remote access solutions, outdated VPN devices, and enterprise portals are frequently targeted to establish a foothold. Organizations can proactively map these weaknesses by utilizing specialized Attack Surface Management to discover exposed assets before they are exploited by RaaS affiliates.
Once inside a Windows system, the locker attempts to elevate privileges. The malware payload leverages seven distinct User Account Control (UAC) bypass methods to execute with administrative privileges without triggering user alerts: ICMLuaUtil COM interface abuse, CMSTP COM interface exploitation, FodHelper registry hijacking, ComputerDefaults execution path manipulation, EventViewer registry key redirection, SilentCleanup elevated task manipulation, and WSReset bypass execution. To maintain stealth, the malware patches Event Tracing for Windows (ETW) and bypasses the Antimalware Scan Interface (AMSI). It also hides its threads from debuggers, uses Process Environment Block (PEB) masquerading, and conducts extensive checks to detect virtual machines or sandbox environments, including VMware, VirtualBox, Hyper-V, and QEMU. If these tools are detected, execution halts immediately to prevent analysis.
With administrative privileges secured, the threat actors execute local credential harvesting. The DarkMatter toolkit includes dedicated modules to dump LSASS memory, hijack security tokens, and query DPAPI storage. Once credentials are stolen, the affiliates execute network reconnaissance to map domain controllers and active SMB shares. They leverage tools like PsExec or Active Directory Group Policy Objects (GPOs) to copy and execute the ransomware across all network-joined machines, creating a coordinated, domain-wide attack.
The core strength of the DarkMatter builder lies in its multi-platform compilation engine. It generates high-performance lockers tailored for Windows (EXE, DLL, PowerShell, and fileless memory-only payloads), Linux (ELF), VMware ESXi, Network Attached Storage (NAS) devices, RedHat, macOS, and cloud storage targets such as AWS S3 and GCP buckets. The Windows encryptor uses the Restart Manager API to close open files and terminate critical services, ensuring databases and enterprise documents can be encrypted. The encryption pipeline leverages up to 20 parallel threads optimized to prevent system crashes. Depending on operator configuration, the ransomware utilizes advanced cryptographic algorithms, including AES-256-CTR, Salsa20, ChaCha20, or a Post-Quantum Hybrid (PQ-Hybrid) pipeline. Encrypted files are given a unique base64 extension derived from the victim's Machine GUID.
Defenders must move away from static signatures, as the DarkMatter builder relies on server-side compilation and polymorphic decryption wrappers that randomize file hashes. Detection strategies must focus on behavioral logic and telemetry events.
Security Operations Centers (SOC) should configure SIEM rules to detect the creation of subprocesses from unusual native binaries. For instance, monitor fodhelper.exe or computerdefaults.exe when they spawn command shells such as cmd.exe or powershell.exe. Additionally, audit registry modifications under the HKCU:\Software\Classes\ms-settings\Shell\Open\command or HKCU:\Software\Classes\exefile\shell\open\command registry paths for unauthorized command entries.
Configure endpoint telemetry to log Event ID 10 (Sysmon ProcessAccess) targeting lsass.exe. Look for access masks such as 0x1F0FFF or 0x1010, which indicate attempts to read the LSASS process memory. Ensure alert rules trigger when rundll32.exe loads comsvcs.dll with the ordinal #24, a common technique for writing LSASS minidumps to disk.
Ransomware operators routinely block recovery mechanisms before encrypting systems. Monitor your environment for the execution of commands designed to destroy backups, including vssadmin.exe delete shadows /all /quiet, wmic.exe shadowcopy delete, and PowerShell commands utilizing WMI to delete shadow copies.
