Dharma ransomware imperils SMBs utilising remote work due to Covid-19

Dharma, a ransomware-as-a-service that has been menacing small and mid-sized businesses since 2016, is now proliferating due to remote work occasioned by the Covid-19 pandemic.

Cyber security firm Sophos analysed Dharma, unmasking an automated attack script and toolset created by the ransomware operators and provided to cybercriminal buyers together with back-end infrastructure and malicious tools.

The main targets for the Dharma RaaS attacks that Sophos analysed are SMBs, with 85 per cent of attacks seen in 2020 focusing on exposed access tools like Remote Desktop Protocol (RDP). This is according to ransomware recovery company, Coveware, which also found that Dharma ransom demands were generally quite low, at $8,620, on average.

RDP is a protocol, or technical standard, for using a desktop computer remotely.

Dharma is one of the most profitable ransomware families around, due to its mass-market, service-based business model. Various iterations of its source code have been dumped online or offered for sale, so many variants of the code now exist.

Read: Canon suffers ransomware attack, hackers threaten data dump if not paid

Once Dharma customers, known as affiliates, have purchased the tools and compromised their target, they rely almost entirely on a menu-driven PowerShell script that installs and launches the components required to spread ransomware across the target’s network. When the master script is executed, it identifies itself as “Toolbox” and launches the attack with the message, “Have fun, bro!”

“Dharma is fast-food franchise ransomware: widely and easily available to just about anyone,” said Sean Gallagher, senior threat researcher at Sophos.

“Dharma’s ransomware-as-a-service offerings expand the range of people who can execute devastating ransomware attacks. That’s worrying enough in itself in normal times. But right now, with many businesses adapting to the pandemic and accommodating a need for rapid support for remote workers, and IT staffs stretched thin, the risks from these attacks are magnified,” he added.

Gallagher warned that the need to equip and enable an unexpectedly remote workforce has left small companies with vulnerable infrastructure and devices. The shift has also hindered the ability of IT support staff to adequately monitor and manage systems the way they normally would.