Dark 101 Ransomware Leverages .NET Binary to Disable Recovery Features

Dark 101 is a newly observed ransomware strain that evades analysis, copies itself to %Appdata% as a trusted-looking svchost.exe, disables recovery mechanisms (vssadmin/wmic/wbadmin commands), alters registry settings to block Task Manager, uses mutexes and selective targeting, and encrypts user files appending random four-character extensions; the report also notes exploitation of backup solutions like Veeam for escalation and lateral movement and emphasizes the need for early detection rather than relying solely on backups.