DarkPhoenix Ransomware Exploits Phishing & RDP to Target Industrial Control Systems

What happened

DarkPhoenix, a ransomware group active since early 2026, has begun a new campaign targeting industrial control systems (ICS). The group distributes spear‑phishing emails containing malicious Office attachments that, when opened, drop a PowerShell script. The script exploits CVE‑2026‑1234, an unpatched Remote Desktop Protocol (RDP) flaw in Windows Server 2019/2022, to gain privileged access and deploy the DarkPhoenix ransomware payload.

Impact

Initial attacks have been reported against manufacturing plants, water treatment facilities, and other critical infrastructure operators in the Midwest and Southeast United States. Victims experience encrypted files, loss of control over PLCs, and potential downtime of essential services.

Indicators of Compromise

• Malicious email subject: “Quarterly Report – FY26” with .docx attachment
• Outbound traffic to IPs in the 198.51.100.0/24 range
• Execution of “powershell.exe –ExecutionPolicy Bypass” with a base64‑encoded payload
• Creation of a file named “darkphoenix.exe” in %ProgramData%

Mitigation

Defenders should immediately:

• Block the known malicious domains and IP ranges listed in the ISC daily feed.
• Apply the latest Windows Server security updates that patch CVE‑2026‑1234.
• Enforce multi‑factor authentication for all RDP access and consider disabling RDP where possible.
• Implement email filtering rules to quarantine attachments with macros and block Office files from unknown senders.
• Isolate compromised systems and perform a forensic analysis before restoring services.