Security News > 2021 > May > DarkSide Wanted Money, Not Disruption from Colonial Pipeline Attack

The statement, which published reports said was posted on the DarkSide ransomware gang's website, is a rare about-face for a known cybercriminal group, which the FBI deemed responsible for the cyberattack that halted pipeline activities for Colonial Pipeline Co. Cybercriminals are typically a proud and boastful bunch that rarely, if ever, show any type of regret or remorse for their attacks.

As the DarkSide gang's chief aim is to extort money from their clients by collecting ransom, attackers now realize they may have been barking up the wrong tree in attacking a major oil pipeline that supplies the East Coast with roughly 45 percent of its liquid fuels.

Calling the attack "a very big 'oops,'" one security expert said the attack shows how effective the DarkSide group has been in ramping up operations "Mostly under the radar" for the last year.

"They have employees, costs, profits, and customer support. DarkSide are going after any business they can make money from, while it would be nice if they would stay after from 'controversial' targets. The reality, most private companies, including banks, do not disclose ransomware. It only becomes public information when it is required to, either through regulation or their business being crippled. The other consideration is while DarkSide are rising in popularity, they are a small player in the ransomware industry, with many other companies willing to take big risks."

So far there have been no reports as to how much ransom DarkSide demanded for the Colonial Pipeline attacks, nor does it appear that Colonial Pipeline in negotiations with the cybercriminal group, according to a published report.

CyberReason said last month that the DarkSide team recently announced on Hack Forums that it had upgraded its offering, releasing DarkSide 2.0, with the fastest encryption speed on this underground market, DarkSide claimed.

News URL

https://threatpost.com/darkside-wanted-money-not-disruption/166016/