dharma
Active2 claimed victims
The claims below are reproduced as posted by dharma on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Dharma is a prolific ransomware family active since at least 2016, evolving from the earlier CrySiS ransomware. It operates under a Ransomware-as-a-Service (RaaS) model, allowing affiliates to deploy customized builds with their own contact emails and extensions. Dharma typically appends encrypted files with patterns like .id-[victimID].[email].dharma or other campaign-specific suffixes. Initial access is often gained through exposed Remote Desktop Protocol (RDP) services secured with weak or stolen credentials, sometimes combined with brute-force attacks.
Description from RansomLook (CC BY 4.0).
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Medservicegroup | June 1, 2020 | ransomware_live | — |
| Carroll County Sheriff's Office and another unspecified agency in the county | December 5, 2016 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).