DarkSide ransomware made $90 million since October 2020

Researchers from blockchain analysis firm Elliptic estimated that Darkside ransomware gang has made over $90 million from its attacks.

Experts from blockchain analysis firm Elliptic estimated that the Darkside ransomware gang has earned over $90 million from ransom payments from its victims since October 2020.

The researchers examined the Bitcoin wallets used by ransomware gang to receive the ransom payments from victims over the past nine months.

“In total, just over $90 million in Bitcoin ransom payments were made to DarkSide, originating from 47 distinct wallets.” reads the report published by the Elliptic. “According to DarkTracer, 99 organisations have been infected with the DarkSide malware – suggesting that approximately 47% of victims paid a ransom, and that the average payment was $1.9 million.”

It seems that ransomware is a profitable business, according to the report the average payment was $1.9 million.

May was set to be a record month, even if the DarkSide ransomware gang shut down its operations on May 13. 

Darkside implements a ransomware-as-a-service (RaaS) model, the core development team keeps 25% of the paid ransoms, and the percentage decrease to 10% if the ransom is larger than $5 million. Elliptic experts speculate Darkside group made roughly $15.5 million, the analysis of the blockchain revealed that the rest of the paid ransoms were transferred to the wallets used by its affiliates.

“This split of the ransom payment is very clear to see on the blockchain, with the different shares going to separate Bitcoin wallets controlled by the affiliate and developer. In total, the DarkSide developer has received bitcoins worth $15.5 million (17%), with the remaining $74.7 million (83%) going to the various affiliates.” continues the report.

The analysis of the blockchain also allowed the experts to follow the ransom payments and determine how crooks cash out the funds. The researchers pointed out that the majority of the funds are being sent to exchanges, which allow swapping for other cryptoassets, or fiat currency.

Unfortunately, not all the exchanges verify their customers’ identity and report suspicious activity, and ransomware gangs like DarkSide use them to convert their funds

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, DarkSide)