DarkSide, the Group Behind the Colonial Pipelines Cyberattack, Offers Ransomware as a Service

To President Biden, DarkSide is a group of “ransomware criminals.” To cybercriminals, it’s a way to hire out hits on profitable companies’ data security for a major payday. And to the group itself, it’s a RaaS—Ransomware as a Service—firm.

If you’re thinking DarkSide sounds familiar for a reason other than Darth Vader quotes, it’s because the FBI believes that the likely Eastern European-based collective was behind this week’s cyberattack on Colonial Pipeline. The ransomware led to the temporary disruption of a pipeline that controls nearly half of fuel flow on the US East Coast.

Big-game hunting

In some ways, DarkSide works like any company: It sells a product, makes guarantees, and takes its reputation “very seriously.” But...it’s also a cybercrime collective. Its product is ransomware; its guarantees are for how targets will be treated; and its reputation is for double extortion, the “current badguy best practice.”

• The group mostly targets large corporations. It says it won’t go after hospitals, nursing homes, companies key to COVID-19 vaccine distribution, funeral service businesses, schools and universities, nonprofit organizations, and the government sector.

Looking ahead: DarkSide claims it doesn’t have political motives—its goal is to “make money” rather than create problems for society, and it plans to adopt a new moderation system before greenlighting further attacks, according to a translated statement. But that likely won’t help its case with the FBI, which has been investigating DarkSide’s ransomware since October. —HF