Since the DarkSide ransomware operation shut down a week ago, multiple affiliates have complained about not getting paid for past services and issued a claim for bitcoins in escrow at a hacker forum.
Russian-language cybercriminal communities typically have an escrow system to avoid scams between sellers and buyers. For ransomware operations, the deposit is a clear statement that they mean big business.
To gain the trust of potential partners and expand the operation, DarkSide deposited 22 bitcoins on the popular hacker forum XSS. The wallet is managed by the site’s administrator, which in this case acts as a guarantor for the gang and an arbitrator if a dispute occurs.
REvil ransomware last year deposited $1 million worth of Bitcoin to a different hacking forum to attract new recruits into the operation. This move showed that they trusted the forum administrator with the money and that there was plenty of money to be made.
Last week, DarkSide closed shop and informed affiliates that the decision came after losing access to their public-facing servers and it was "due to the pressure from the US" after the attack on Colonial Pipeline.
Unpaid debts
DarkSide’s dissolving of the ransomware-as-a-service (RaaS) operation was abrupt and clearly left some unfinished business. Five partners have complained that the operators owed them money from paid ransoms or from hacking services:
The first affiliate asking for claim states that they were the 'pentester' for an attack and was owed 80% of the ransom payment. However, after the victim paid, the DarkSide operators stated they ..
Support the originator by clicking the read the rest link below.
