Deep dive on the DarkSide ransomware gang, which pressures victims into paying via phone calls by affiliates, DDoS attacks, and threats of tipping short sellers
The FBI confirmed this week that a relatively new ransomware group known as DarkSide is responsible for an attack …
Krebs on SecurityBrian Krebs
Context & Ripple Effects
Reports days earlier tied DarkSide to an incident that halted Colonial Pipeline operations and involved the theft and encryption of roughly 100GB of data before a ransom demand. The FBI confirmation places the group’s pressure tactics in the context of a disruption already affecting a critical operator.
DarkSide had publicly promised more moderation in target selection while insisting its aim was profit rather than social disruption. The reported use of calls, DDoS and market-facing threats shows how its affiliates sought to turn that profit motive into leverage beyond encryption alone.
First-order effects
DarkSide victims face a coordinated payment campaign: affiliates can combine encrypted or stolen data with phone pressure, DDoS disruption and threats aimed at investors.
DarkSide’s affiliate model gives the group multiple ways to raise the cost of refusing a ransom without relying solely on the initial intrusion.
Second-order effects
Organizations hit by DarkSide must treat ransom response as an operational, communications and market-risk problem, not only an incident-response exercise.
Ransomware operations are evolving into multi-channel extortion businesses, with affiliates monetizing stolen data, service disruption and reputational pressure alongside file encryption.
If this operating model persists, defensive planning will increasingly need to coordinate cyber recovery with executive communications and continuity measures for DDoS-driven outages.
The trend: Ransomware groups are broadening from encryption-led attacks into affiliate-run extortion campaigns that apply operational, reputational and market pressure at once.
Here's a closer look at DarkSide, the relatively new ransomware-as-a-service platform that's been holding 5,500 miles of fuel pipeline hostage. Story includes negotiations btwn DarkSide & a $15B victim that recently negotiated a $30M demand down to $11M. https://krebsonsecurity.c…
@SecurePeacock @SteveMoscarelli @FoxBusiness The FBI statement did say the Darkside ransomware was to blame which right could be a variety of groups but are at fault as they provide the ransomware service. That's bolstered by Darksides PR statement earlier... https://www.fbi.gov/…
I'm seeing DarkSide's statement framed as an apology. It is not, no more than other ransomware gangs' promises to not hit hospitals or NGOs are evidence of noble intent. It's MAYBE an acknowledgement they could face consequences after their peers who bricked US hospitals didn't. …
Even after the pipeline is reopened, it's going to take 15 days to get gasoline from Houston to the East Coast https://www.bloomberg.com/... https://twitter.com/...
Energy Secretary Granholm says Colonial believes it will be in a position by end of business Wednesday to make a decision on whether to bring its pipeline fully back online. Even if they do that, it will take a couple of days before fuel supply is normalized, Granholm says.
The hackers that shut down the gasoline pipeline have apologized. They say they never wanted to cause all this disruption and that they just wanted to make money. They've promised to do better going forward. https://www.bloomberg.com/... https://twitter.com/...
In March DarkSide introduced “call service” to arrange calls pressing victims to pay; in April they added ability to launch DDoS attacks against victims to turn up heat. DarkSide has also said it's willing to sell info about upcoming victims so scammers can short company's stock …
Pro tip for the “but how do we protect ourselves?” folks. DarkSide ransomware, like many other strains, will not install on systems where certain Cyrillic keyboard and other scripts are already installed. So, install the Russian keyboard. You don't have to use it.
The assumption is that Darkside is not nation state affiliated, but like oh-so-many ransomware groups it uses tools like “GetUserDefaultLangID” to perform language checks. If the victim uses any languages below, DarkSide moves on. https://twitter.com/... https://twitter.com/...
People discussing the relationship between ransomware teams and the Russian government should probably keep @Jason_Healey's “Spectrum of National Responsibility” in mind. Right now, it looks like the Darkside group that attacked Colonial is at least “State-Encouraged”. https://tw…
I don't think people appreciate how effectively Darkside has been ramping up operations mostly under the radar for the last year. This was a very big “oops”. They were doing a really good job of decimating businesses, including infrastructure - and everyone has been really quiet.
The criminals responsible, Darkside, are a relative newcomer to ransomware, but have an intriguing “code of conduct.” They will not extort hospitals, funeral homes, non profits. They do target large corps and sometimes donate some proceeds to charities (that return the $).
The ransomware attack on Colonial Pipeline has prompted emergency meetings as the White House finalizes its cybersecurity Executive Order. With new details on the attack and the EO w/ @SangerNYT https://www.nytimes.com/...