Playing Whack-a-Mole With New Dharma Ransomware Variants

The Dharma ransomware family was initially identified in 2016 and operates as a Ransomware-as-a-Service (RaaS) model. Incidentally, one version of the ransomware was leaked and whomever gained access altered it to suit their needs. The malware uses multiple initial access vectors such as exposed Microsoft Remote Desktop Protocol (RDP) servers and phishing with attachments masquerading as legitimate software. The ransomware encrypts files within the system and launches mshta.exe to display an HTML file containing ransom details.