DarkRace

DarkRace, also known as DarkTrace, is a cybercriminal gang engaged in ransomware operations. The group’s headquarters is located in Italy. DarkRace is recognized for deploying ransomware to encrypt victims’ data and subsequently stealing sensitive information. The gang maintains a darknet data leak site where it threatens to publish stolen data unless a ransom is paid. The alias DarkTrace appears alongside DarkRace in various threat intelligence references.

On June 3, 2023, DarkRace claimed responsibility for a ransomware attack against the Italian company CONATECO. CONATECO is described as a large container terminal operator based in Naples. According to the group’s claim, the attack resulted in the exfiltration of approximately 46 gigabytes of data. The victim’s website was rendered inaccessible, displaying only a maintenance message accompanied by numerous 404 errors. DarkRace announced the breach on its darknet leak site and warned that the stolen information would be released if demands were not met. The incident exemplifies the group’s use of double extortion tactics combining data theft with service disruption.

Ransomware groups like DarkRace typically infiltrate target networks through phishing, exploited vulnerabilities, or compromised credentials. Once inside, they deploy malware that encrypts files, rendering critical systems unusable. Simultaneously, they exfiltrate data to leverage additional pressure via threatened public disclosure. Payment demands are usually made in cryptocurrencies to obscure the transaction trail. The presence of a leak site allows the group to follow through on threats, publishing data samples to validate claims and incentivize compliance. These tactics have become common among financially motivated cybercriminal enterprises operating globally.

Publicly available information about DarkRace remains limited to the aforementioned CONATECO incident and occasional mentions in threat‑intel feeds. No verifiable details regarding the group’s size, organizational structure, membership, or affiliations have been disclosed. Consequently, any profile of DarkRace must rely on observed behavior and the specific claims associated with the June 2023 attack. As further incidents are reported or investigated, a more comprehensive understanding of the group’s capabilities and scope may emerge.