DarkSide

DarkSide, also tracked as darkside_group, is a financially motivated cybercriminal operation first observed around August 2020. It operated a ransomware-as-a-service program, developing ransomware and maintaining infrastructure for affiliates that compromised organizations and deployed company-specific ransomware builds. The operation maintained a data-leak site and used public statements to communicate with victims and the media. Its published targeting restrictions prohibited attacks on hospitals, schools, and government organizations, but did not reliably prevent attacks with serious public consequences. DarkSide is best known for the May 7, 2021 ransomware attack carried out by an affiliate against Colonial Pipeline in the United States. The intrusion involved a compromised VPN account without multifactor authentication and affected business IT and billing systems. Colonial Pipeline temporarily halted pipeline operations as a precaution, disrupting fuel distribution across the U.S. East Coast; direct compromise of operational technology was not established. Following heightened law enforcement scrutiny, DarkSide announced the closure of its affiliate program in May 2021. U.S. authorities subsequently recovered part of the Colonial Pipeline ransom payment. The FBI has linked ALPHV developers and money launderers to DarkSide and BlackMatter, but these personnel connections do not establish that the operations were identical.