Dharma/CrySiS Source Code Is for Sale on the Dark Web

• The source code of Dharma is available for sale for only $2,000, possibly helping unlock one of the nastiest strains out there.
• Dharma has made over $24 million to its actors, hitting thousands of users, companies, and organizations.
• Dharma is impossible to unlock because it has no flaws in the implementation of its encryption algorithm.

Reportedly, the source code of the Dharma/CrySiS ransomware has been put up for sale on two separate darknet forums this weekend, and the cost is a mere $2,000. The reason why this is far too low for the particular ransomware is that we’re talking about one of the most robust strains available out there, featuring a perfect implementation of a strong encryption algorithm that researchers haven’t been able to break since its release in 2016. Dharma has troubled thousands of victims and already extorted more than $24 million in payments.

Dharma’s authors used its technical excellence to set up a lucrative RaaS (ransomware as a service) business, managing to take the strain to second place only after Ryuk. Many of the actors who picked up Dharma used their own iterations of the strain. At the same time, the original author continued to push updates, and Dharma was gradually adjusted to become more effective when hitting high-profile targets. Even after the eventual leak of the master-keys of one of Dharma’s forks, Phobos, the chances of having Dharma unlocked remained as low as 50%. Phobos and Dharma together accounted for about 20% of the total ransomware infections that occurred in Q4 2019, so we’re talking about actively used strains and not just a niche strain.

All of this gives you an overview of why the Dharma source code would be so valuable to white-hat researchers, as reverse-engineering the decryption key could now become possible. The source code is the “raw” programming language instructions that pass through a code compiler to become executable binaries. So, it is the “recipe” for creating programs, revealing all secret ingredients that cannot be deduced solely by analyzing the resulting files, as well as any potential flaws in the code. So now this is where the researchers will focus now.

So far, Dharma has been one of the reasons why people were advised to keep offline backups and never execute files from untrustworthy sources. From those who opted to pay the Dharma ransomware actors these years, only about 12% got the promised decryption keys back. All that said, if you have suffered a Dharma infection, you are advised to wait a while, as the situation has suddenly taken an unexpected positive turn. It is now likely that a Dharma decryptor will be released in the upcoming weeks or months, so stay tuned.

Related

LockBit Ransomware Group Returns, Launching 4.0 in February

Rhode Island Hit by Ransomware Attack Impacting Deloitte via RIBridges

Lynx Ransomware Targets Romanian Energy Supplier Electrica

Romanian Electricity Distributor (Electrica) Is Under a Ransomware Attack

Heart Surgery Device Maker, Artivion, Discloses a Ransomware Attack

BT Group Affected by Ransomware Breach by Black Basta Gang

Most Popular

Attack on Titan: The Last Attack- all the Confirmed International Theatrical Release Dates

Den of Thieves 2: Pantera- All we know About the sequel to the Surprise hit Heist film

Does Sonic 3 have a Post-Credits Scene?

What we know so far About Virgin River Season 7

Colleen Hoover’s Verity Movie Adaptation adds two more Hollywood Stars to its cast

Stranger Things Season 5 Release date: One good news and one bad news for fans