Loading story…
Blockchain analysis linked DarkSide to at least $90 million in bitcoin ransom payments over roughly nine months, tracing funds across 47 wallets tied to the ransomware-as-a-service operation. Two of the group’s most prominent victims accounted for about $10 million of that total: Colonial Pipeline, which paid nearly $5 million, and chemical distributor Brenntag, which paid $4.4 million. The gang’s affiliate model reportedly gave partners 75% to 90% of each payment, while the core operators retained a smaller share that still amounted to about $15.5 million in bitcoin.
DarkSide’s campaign also involved data theft as well as encryption. Brenntag said attackers accessed its North America systems in late April 2021, exfiltrating sensitive personal data affecting more than 6,700 individuals, including Social Security numbers, dates of birth, driver’s license numbers, and some medical information; the company said DarkSide claimed to have stolen 150GB of data and that access may have been obtained through purchased stolen credentials. After the Colonial Pipeline attack drew intense scrutiny, DarkSide said it lost control of parts of its infrastructure and some ransom funds before abandoning operations, while major cybercrime forums including XSS, Exploit, and RAID banned ransomware advertisements and other gangs shifted toward private affiliate arrangements rather than disappearing entirely.
TTPs, infrastructure, and targeting history in one profile.
13 events from the most recent confirmed update back to the earliest known activity.
In late June 2021, Brenntag sent breach notification letters to more than 6,700 affected individuals after determining personal data had been exfiltrated.
After DarkSide's reported shutdown, REvil told affiliates they must obtain approval before targeting organizations and barred attacks on healthcare, education, and government entities. The change was presented as a response to increased pressure following the Colonial Pipeline incident and DarkSide disruption.
Elliptic published analysis showing DarkSide had collected at least $90 million in roughly nine months and that its developers received about $15.5 million of that total.
President Biden delivered public remarks on the Colonial Pipeline incident, providing an official U.S. government response as scrutiny intensified around ransomware and DarkSide. The statement came the same day DarkSide said it was shutting down operations.
DarkSide's operations closed on May 13, 2021 after fallout from the Colonial Pipeline incident; the group said it had lost control of some servers and some ransom funds.
Brenntag sent DarkSide a $4.4 million ransom payment on May 11, 2021 to obtain a decryptor and prevent publication of stolen data.
Brenntag became aware of the attack on April 28, 2021 and disconnected impacted systems from its network after discovering the incident.
Brenntag said attackers linked to DarkSide began unauthorized access to its North America systems on April 26, 2021.
Elliptic identified DarkSide ransom transactions totaling just over $90 million since October 2020 across 47 Bitcoin wallets, establishing the scale of the group's earnings.
DarkSide began operating as a ransomware-as-a-service group in August 2020, using affiliates to breach victims, steal data, and deploy encrypting malware.
The Record reported that smaller ransomware groups Ako (Razny) and Everest appeared to shut down over the weekend amid pressure on the ransomware ecosystem.
After DarkSide disappeared, REvil and Avaddon announced they would stop advertising on forums and continue operating privately with existing affiliates and recommendations.
Following the Colonial Pipeline fallout, the XSS, Exploit, and RAID forums banned ransomware advertisements, signaling a shift in how ransomware groups could recruit and operate publicly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceelliptic.co
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcewhitehouse.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Colonial Pipeline shut down its fuel distribution network after a ransomware attack hit the company’s business systems, disrupting a pipeline that carries about **45% of the East Coast’s fuel supply**. The outage triggered supply concerns across the eastern United States, prompted fuel sellers and traders to seek alternatives, and led the U.S. government to invoke emergency powers to ease transportation constraints as gasoline shortages and panic buying spread in some markets. The FBI attributed the intrusion to the **DarkSide** ransomware group, making the incident one of the most consequential cyberattacks on U.S. critical infrastructure. Colonial later restored service and said operations had returned to normal, while reports said the company paid roughly **$5 million** to the attackers; the company also said its operational technology systems did not appear to have been directly affected, but that it had taken systems offline as a precaution and would increase cybersecurity investment.
Jun 29, 2026
The **DarkSide** ransomware operation said it was building a distributed storage platform in **Iran** to host and publish data stolen from victims, a move intended to make law-enforcement disruption and infrastructure takedowns more difficult. The group described itself as a private **ransomware-as-a-service** operation in which core developers supply the malware and payment systems while affiliates breach targets and split ransom proceeds. DarkSide also used a Russian-speaking cybercrime forum to recruit affiliates, claiming participants earn about **$400,000 per victim** on average, and posted a **20 BTC** deposit—worth roughly **$320,000** at the time—to signal financial credibility. The gang said it would avoid attacks on healthcare, education, non-profits, and government entities, but the report noted it was unclear whether those restrictions would be enforced in practice.
Aug 14, 2026
BlackMatter launched as a ransomware-as-a-service operation focused on **large enterprises** in the US, UK, Canada, and Australia, seeking victims with at least **$100 million in annual revenue** and roughly **500 to 15,000 hosts**. The group recruited initial access brokers on underground forums and offered up to **$100,000** for exclusive network access, while advertising support for **Windows, Linux, VMware ESXi, and NAS** environments. Researchers and incident responders linked BlackMatter to **DarkSide** through overlapping targeting language, underground tradecraft, and technical similarities in the malware, including use of **Salsa20** and **RSA-1024**; ransom demands reportedly reached **$3 million to $4 million**. The operation presented itself as avoiding hospitals, government, defense, and critical infrastructure, but reporting tied it to attacks affecting major organizations and parts of critical U.S. infrastructure. By early November, BlackMatter told affiliates it was shutting down, saying pressure from local authorities had made part of the team unavailable and that its infrastructure would be taken offline within 48 hours, while decryptors would remain available on request. The closure followed mounting scrutiny that connected BlackMatter to **DarkSide** and **FIN7**, secret victim assistance from **Emsisoft** via a decryptor, and broader law-enforcement pressure on ransomware groups after high-profile incidents such as the Colonial Pipeline attack.
Aug 15, 2026