Threat Actor: Dharma & Crysis Ransomware Affiliates
Dharma & Crysis Ransomware Affiliates is classified as an advanced Organized Cybercrime Syndicate originating primarily from Eastern Europe. Driven by operational objectives spanning rdp brute-forcing, manual network lateral movement & small business extortion, this threat entity has maintained an active footprint from 2016 - Present. In enterprise telemetry and malware repository classification, Dharma & Crysis Ransomware Affiliates has been corroborated across 2 distinct malware families with over 43 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | Crysis Operators, Gold Southfield Affiliates, Dharma Ransomware Crew |
|---|---|
| Targeted Sectors | Small-to-Midsize Enterprises, Medical Clinics, Municipal Accounting Departments |
| Primary Motivations | RDP Brute-Forcing, Manual Network Lateral Movement & Small Business Extortion |
| Dominant Payload Categories | Ransomware |
| MITRE ATT&CK Reference | https://attack.mitre.org/software/S0241/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by Dharma & Crysis Ransomware Affiliates:
T1486— weaponized across 2 catalog payload(s)T1490— weaponized across 2 catalog payload(s)T1133— weaponized across 1 catalog payload(s)T1083— weaponized across 1 catalog payload(s)T1070.004— weaponized across 1 catalog payload(s)T1078.002— weaponized across 1 catalog payload(s)T1562.001— weaponized across 1 catalog payload(s)T1021.001— weaponized across 1 catalog payload(s)T1047— weaponized across 1 catalog payload(s)
Exploited Vulnerabilities (CVEs)
Telemetry confirms Dharma & Crysis Ransomware Affiliates has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2017-0144 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-10271 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (2 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to Dharma & Crysis Ransomware Affiliates:
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| crysis | Ransomware | 24 | Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emer... |
| crusis | Ransomware | 19 | Crusis (widely known in the cybersecurity community as the CrySiS or Dharma ransomware family and cataloged by Microsoft as Ransom:Win32/Crusis) is an infamous ... |
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by Dharma & Crysis Ransomware Affiliates requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).