DarkBit ransomware

DarkBit is a Go-based Windows ransomware that appeared in February 2023. It appends .Darkbit to encrypted files, writes RECOVERY_DARKBIT.txt, and stamps each file with a DARKBIT_ENCRYPTED_FILES marker. It deletes shadow copies and splits large files into segments before encrypting them. It hit Israeli organisations with a political message. Payloads spread from domain controllers through Group Policy, and the same campaign wiped cloud resources. The note threatened to sell stolen data. The operation is tied to the Iranian actor Microsoft tracks as MERCURY (Mango Sandstorm), with ransomware used as cover for destruction.

File extensions: .Darkbit

Decryptor: Decryptor availability has not been recorded.