DarkSide Ransomware Used in Cyberattack on Colonial Pipeline
Note: We may earn a commission from products or services when you click on a link and make a purchase.
The US Federal Bureau of Investigations (FBI) has confirmed that DarkSide ransomware was used in the cyberattack on colonial pipeline Co. According to an FBI statement, the ransomware attack is the work of Russian cybercriminals.
“The FBI confirms that the Darkside ransomware is responsible for the compromise of the Colonial Pipeline networks. We continue to work with the company and our government partners on the investigation,” said the law enforcement agency in a statement on Monday.”
RELATED STORIES
- Ransomware Shutsdown Largest US Pipeline: Saturday Sitrep
- Major US Gas Pipeline still offline due to cyberattack, Feds declare emergency
DarkSide ransomware attacked Colonial Pipeline’s IT network on Friday causing the pipeline operator to take systems offline which crippled its refined oil deliveries.
DarkSide is a gang of cyber criminals who attack companies in the U.S. and Europe.
Like many ransomware attackers, it appears that DarkSide’s motive was to make money rather than to damage US critical infrastructure.
According to Krebs on Security, post by DarkSide reads, “We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other our motives [sic],” reads the post on the DarkSide Leaks site. “Our goal is to make money, and not creating problems for society. From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.”
READ Russia Denies Responsibility for SolarWinds Cyberattack
Ransomware is a genre of malicious computer coding. Cyber criminals use ransomware to attack and encrypt computers, IT networks, and all the devices attached to them. They hold the infected computers and the data on them data hostage until their ransom demands for money are paid.
Ransomware attacks against large corporations can cost the victim millions of dollars.
Our Most Popular Cyber Security Training Courses
- Google Cloud Security
- Google Cloud Networking
- Introduction to Cybersecurity Tools & Cyber Attacks
- Linux Security
- Cyber Security 10 Domains
- IBM Fundamentals
- AWS Cloud Native
Remediation Time Still Unknown
It is still unknown when Colonial will be able to get its systems back online. The company has hired cyber security experts at FireEye to help with the remediation effort and forensic investigation.
Over the weekend, The US Federal Motor Carrier Safety Administration (FMCSA) issued an Emergency Declaration making it easier for truck transports to continue fuel deliveries while the pipeline remains disabled.
“The Federal Bureau of Investigation has determined Colonial’s network was infected by ransomware, and it’s a criminal act, obviously,” said US President Joe Biden.
Both the US Department of Energy and the FBI are working with Colonial Pipeline to get the pipeline operating again.
Colonial pipeline supplies refined fuel to 45% of the East Coast of the United States. The company operates 5,500 miles of pipeline which delivers heating fuel, automobile gasoline, and jet fuel from the Gulf of Mexico – Texas to New York.
