Loading story…
The United States said it secretly removed malware from internet-connected devices worldwide to blunt potential Russian cyberattacks, using court-authorized operations to access vulnerable systems before they could be weaponized. The action reflected a more aggressive U.S. cyber posture as officials warned that Russia could retaliate digitally amid broader geopolitical tensions, and it underscored Washington's willingness to conduct pre-emptive disruption beyond domestic networks.
The disclosure followed heightened concern over Russian-linked cyber threats after the Colonial Pipeline attack, which the FBI attributed to the DarkSide ransomware group. President Joe Biden said there was no evidence the Russian state directly ordered that intrusion, but he argued Moscow was responsible for criminal groups operating from its territory and should act against them. The pipeline shutdown disrupted fuel distribution in the eastern United States, prompted emergency regulatory measures, and intensified scrutiny of ransomware gangs and the governments that tolerate them.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
The U.S. government disclosed that it had covertly removed malware from computer systems around the world in an effort to head off potential Russian cyberattacks. The operation was publicly reported by The New York Times on the same day.
President Joe Biden said there was no evidence the Russian state was directly involved in the Colonial Pipeline hack, but said Russia bore responsibility for ransomware actors operating from its territory. The administration also coordinated a federal response and eased petroleum transport rules to reduce disruption.
As the response continued, Colonial Pipeline said its main lines remained offline while some smaller lateral lines were being restored. The company said it expected substantial service restoration by the end of that week.
Colonial Pipeline was hit by a ransomware attack that led the company to shut down its pipeline operations. The FBI attributed the intrusion to the DarkSide ransomware group.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcenytimes.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A ransomware attack on Colonial Pipeline’s IT environment forced the company to temporarily halt pipeline operations, causing fuel supply disruptions across parts of the United States. Dragos said with high confidence that the **DarkSide** ransomware group was responsible for the compromise and described the incident as the most disruptive cyber intrusion it had seen affecting U.S. energy infrastructure. The shutdown highlighted how closely linked IT and OT environments can be in industrial organizations, allowing an enterprise-system intrusion to trigger major operational consequences. As Colonial Pipeline restarted service, U.S. officials warned that fuel availability would recover gradually and urged the public not to panic-buy gasoline or accept price gouging. The FBI said the Russian government was not behind the attack, though the perpetrators were believed to be operating from Russia. Reporting on the incident also pointed to common ransomware entry paths, including weak passwords on internet-exposed services and exploitation of devices such as **Pulse Connect Secure**, **Fortinet FortiOS**, and **Accellion FTA**, while recommended defenses included stronger network segmentation, improved monitoring and logging, offline backups, and exercised OT incident response plans.
Aug 15, 2026
Colonial Pipeline shut down its fuel distribution network after a ransomware attack hit the company’s business systems, disrupting a pipeline that carries about **45% of the East Coast’s fuel supply**. The outage triggered supply concerns across the eastern United States, prompted fuel sellers and traders to seek alternatives, and led the U.S. government to invoke emergency powers to ease transportation constraints as gasoline shortages and panic buying spread in some markets. The FBI attributed the intrusion to the **DarkSide** ransomware group, making the incident one of the most consequential cyberattacks on U.S. critical infrastructure. Colonial later restored service and said operations had returned to normal, while reports said the company paid roughly **$5 million** to the attackers; the company also said its operational technology systems did not appear to have been directly affected, but that it had taken systems offline as a precaution and would increase cybersecurity investment.
Jun 29, 2026
U.S. officials stepped up warnings and coordination with industry over potential Russian cyberattacks tied to the Ukraine crisis, urging organizations to report signs of reconnaissance, exploitation testing, malware development, and compromises involving industrial control systems. The FBI, CISA, DHS, NSA, Treasury, Energy Department, and allied partners increased intelligence sharing and defensive preparations as officials cited the risk that destructive activity already hitting Ukrainian entities could spill over to U.S. and foreign companies with operations in Ukraine, particularly across **energy, healthcare, finance, and other critical infrastructure** sectors. The concern was grounded in a documented history of Russian operations against operational technology and the energy sector. Prior U.S. government reporting detailed campaigns targeting critical infrastructure, while Treasury sanctioned a Russian state research institution linked to the **Triton/Trisis** malware used against Schneider Electric safety systems. The Justice Department later charged four Russian government-linked individuals over the **Triton/Trisis** and **Dragonfly/Havex** campaigns, alleging long-running efforts to compromise **SCADA** and industrial control environments at hundreds of organizations in roughly 135 countries to enable future disruption or physical damage.
Aug 15, 2026