Cyber Threat Actor: Dark Power

Dark Power is a ransomware group known by that alias. The group is associated with Russia as its known location. They came to public attention in March 2023 when they claimed responsibility for an attack on a Peruvian reconstruction agency. The targeted entity, Autoridad para la Reconstrucción con Cambios (ARCC), oversees rebuilding infrastructure damaged by El Niño. Dark Power listed ARCC on a leak site they operate to signal the compromise. The group asserted they had exfiltrated data and made it available for download.

To facilitate access, Dark Power invited interested parties to contact them via the Tox messaging platform. Despite this invitation, the group was not online when outreach attempts were made by reporters. Consequently, Dark Power provided no interactive communication channels, which hindered independent verification of the claimed breach. The affected agency did not issue any public acknowledgment or response regarding the incident on its own platforms. Peru’s National Center for Digital Security was notified externally and confirmed it would coordinate with the entity to address the reported security breach. These actions constitute the publicly reported behavior of Dark Power as observed in the March 2023 incident.