Darkside

DarkSide is a ransomware-as-a-service operation that emerged in 2020 and became widely known for the 2021 Colonial Pipeline incident. It operated through a core developer team and affiliates, with the operators providing ransomware tooling and management infrastructure while affiliates conducted intrusions and deployments. DarkSide is associated with financially motivated double-extortion activity in which victim data is stolen before encryption and later used to pressure payment through threatened publication. Public reporting has linked the operation to dozens of intrusions and to targeting of enterprises in sectors including energy and other large organizations, with especially high-profile impact on critical infrastructure through the Colonial Pipeline disruption.

DarkSide intrusions have been associated with multiple initial access methods depending on the affiliate, including use of stolen or phished credentials, credential-based VPN access, brute-force activity, exploitation of CVE-2021-20016 on SonicWall SMA100 appliances, and phishing-delivered backdoor access. Once inside a network, affiliates have been observed maintaining dwell time ranging from a few days to several weeks, conducting reconnaissance, exfiltrating data, and moving laterally with administrative protocols and remote access mechanisms such as RDP, SSH, and PSExec. Reported affiliate tradecraft also included persistence through remote administration software and use of commodity or dual-use tooling such as Cobalt Strike and SystemBC.

The malware supports both Windows and Linux environments. The Windows variant encrypts files, attempts privilege escalation via the CMSTPLUA technique when needed, terminates backup, mail, and database-related services to maximize impact, tampers with security tooling, and deletes Volume Shadow Copies to inhibit recovery. The Linux variant is an ELF payload that has been reported targeting VMware virtualized environments by encrypting VMDK files on ESXi systems. DarkSide’s operational model and technical behavior place it among the more mature ransomware families of its period, combining enterprise-focused intrusion tradecraft with extortion infrastructure and affiliate management.

DarkSide publicly claimed to be apolitical and profit-driven and stated that it avoided certain victim categories, but its affiliate model limited centralized control over target selection and operational consequences. The operation is widely assessed as part of the Russian-speaking cybercriminal ecosystem, though publicly available information does not establish it as a state-directed capability. The group became defunct after intense law-enforcement and public scrutiny following Colonial Pipeline, including a U.S. Department of Justice seizure of part of the ransom proceeds.