- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Sources
- 2 sources carry it
- Identifier
- GINC-APT-1110 · darkrace
What it is
DarkRace is a moderately destructive ransomware strain observed since 2024. It encrypts files and appends a randomized extension (e.g., .1352FF327) that varies per victim. Implemented as a 32-bit Windows application, it disables antivirus defenses, deletes volume shadow copies, terminates processes, and drops ransom note files for payment negotiation. Technical weaknesses in its encryption have enabled developers to produce a universal decryptor that works against DarkRace and related variants.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Darkrace gang, Darkrace group, Darkrace ransomware
Tools
The tools and malware families the sources tie to it.
- DarkRat
- Virus RAT
- Windows Remote Desktop