Description
DarkSide is a ransomware operation that attacked Colonial Pipeline in 2021, an incident that disrupted fuel supply to the United States East Coast and made ransomware a national security topic. Its affiliates ran a professional operation with a leak site, data exfiltration, and negotiation support, and the group shut down after the attack drew intense government pressure. Its code base and personnel reappeared in the BlackMatter operation later that year.
Stats
- First seen
- February 2022
- Last seen
- October 2026
Also known as
Darkside
Alert name variants
| Alert Name |
|---|
| Gen:Variant.Ransom.DarkSide.103 |
| Gen:Variant.Ransom.DarkSide.116 |
| Gen:Variant.Ransom.DarkSide.16 |
| Gen:Variant.Ransom.Darkside.2 |
| Gen:Variant.Ransom.DarkSide.20 |
| Gen:Variant.Ransom.DarkSide.21 |
| Gen:Variant.Ransom.DarkSide.23 |
| Gen:Variant.Ransom.DarkSide.37 |
| Gen:Variant.Ransom.DarkSide.44 |
| Gen:Variant.Ransom.DarkSide.55 |
