Mandiant observed DARKSIDE affiliate UNC2465 accessing at least one
victim through a Trojanized software installer downloaded from a
legitimate website. While this victim organization detected the
intrusion, engaged Mandiant for incident response, and avoided
ransomware, others may be at risk.
As reported in the Mandiant post, "
a Light on DARKSIDE Ransomware Operations," Mandiant
Consulting has investigated intrusions involving several DARKSIDE
affiliates. UNC2465 is one of those DARKSIDE affiliates that Mandiant
believes has been active since at least March 2020.
The intrusion that is detailed in this post began on May 18, 2021,
which occurred days after the publicly reported shutdown of the
overall DARKSIDE program (
Advantage background). While no ransomware was observed here,
Mandiant believes that affiliate groups that have conducted DARKSIDE
intrusions may use multiple ransomware affiliate programs and can
switch between them at will.
Sometime in May 2021 or earlier, UNC2465 likely Trojanized two
software install packages on a CCTV security camera provider website.
Mandiant determined the installers were malicious in early June and
notified the CCTV company of a potential website compromise, which may
have allowed UNC2465 to replace legitimate downloads with the
Trojanized ones.
While Mandiant does not suspect many victims were compromised, this
technique is being reported for broader awareness. Software supply
chain attacks can vary greatly in sophistication, from the recent
FireEye-discovered
attacks to attacks such as this targeting smaller providers. A
software supply chain attack allows a single intrusion to obtain the
benefit of access to all of the organizations that run that victim
company’s software; in this case, an installer, rather than the
software itself, was modified by UNC2465.
In mid-May 2021, Mandiant observed multiple threat actors cite an
announcement that appeared to be shared with