Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
1 malware family

DarkSide

Also known asdarkside

DarkSide is a ransomware-as-a-service (RaaS) cybercriminal operation best known for the May 2021 Colonial Pipeline attack, which the FBI attributed to the group and specifically to a DarkSide affiliate. The group is described in the content as Russia-based or operating from Eastern Europe/Russia, though the content does not confirm a nation-state link; U.S. officials stated the actors were in Russia but not part of the Russian government. DarkSide used an affiliate model in which operators supplied ransomware, tooling, management panels, and leak-site capabilities in exchange for a share of ransom proceeds. The group conducted double extortion, stealing data before encrypting systems and threatening public release if victims did not pay. The content states DarkSide was responsible for at least 60 known double-extortion cases in the referenced period. DarkSide is associated with the Colonial Pipeline disruption, which caused shutdown of pipeline operations and fuel shortages on the U.S. East Coast. Colonial Pipeline paid roughly $4.3 million to $4.4 million in Bitcoin, and the U.S. Department of Justice later seized approximately $2.3 million of those proceeds. DarkSide publicly claimed to be apolitical and profit-motivated, and after the Colonial incident stated it would review targets to avoid social consequences. The content also states DarkSide claimed to avoid certain targets, including public-interest sectors such as healthcare and vaccine-related entities, but its affiliate model limited operator control over victim selection. Observed tradecraft in the content includes initial access via phished or stolen VPN credentials, brute force and password spraying against exposed remote services, and exploitation of SonicWall SMA100 vulnerability CVE-2021-20016 by an affiliate cluster. Affiliates and related intrusion clusters used suspicious authentication attempts, phishing, TeamViewer persistence, Smokedham .NET backdoor delivery, NGROK to expose remote desktop services, and tools such as Cobalt Strike and SystemBC. Lateral movement methods included PSExec, RDP, and SSH. Data was exfiltrated to Mega or pCloud. On Windows, DarkSide attempted privilege escalation via CMSTPLUA, terminated backup and database services including Commvault, Veeam, MailEnable, and SQL Server, tampered with Sophos services, and deleted Volume Shadow Copies. The Linux variant was delivered as an ELF binary and targeted VMware ESX VMDK files under /vmfs/volumes/. The content links DarkSide to later rebrands and spinoffs. It states BlackMatter and then BlackCat/ALPHV are believed to be successor or rebranded operations following law-enforcement pressure after Colonial Pipeline. The content also references affiliates and associated actors including Wazawaka/Mikhail Matveev as having worked with DarkSide, and notes FireEye tracking of DarkSide affiliate clusters including UNC2628, UNC2659, and UNC2465.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Transportation

Where they target

Geographies tied to known operations.

  • 🇺🇸 United States
MITRE ATT&CK

Tradecraft

44 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

15 of 15 tactics58 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1598
Phishing for Information
T1598.004
Spearphishing Voice
TA0042
Resource Development
2 techniques
T1583
Acquire Infrastructure
T1583.006
Web Services
T1588
Obtain Capabilities
T1588.002
Tool
TA0001
Initial Access
2 techniques
T1078×4
Valid Accounts
T1133×2
External Remote Services
TA0002
Execution
1 technique
T1059
Command and Scripting Interpreter
T1059.001
PowerShell
TA0003
Persistence
5 techniques
T1078×4
Valid Accounts
T1112×2
Modify Registry
T1133×2
External Remote Services
T1543
Create or Modify System Process
T1543.003
Windows Service
T1546
Event Triggered Execution
T1546.001
Change Default File Association
TA0004
Privilege Escalation
5 techniques
T1068
Exploitation for Privilege Escalation
T1078×4
Valid Accounts
T1543
Create or Modify System Process
T1543.003
Windows Service
T1546
Event Triggered Execution
T1546.001
Change Default File Association
T1548
Abuse Elevation Control Mechanism
T1548.002×2
Bypass User Account Control
T1548.003
Sudo and Sudo Caching
TA0005
Stealth
4 techniques
T1027×2
Obfuscated Files or Information
T1070
Indicator Removal
T1070.004
File Deletion
T1078×4
Valid Accounts
T1140
Deobfuscate/Decode Files or Information
TA0112
Defense Impairment
1 technique
T1112×2
Modify Registry
TA0006
Credential Access
1 technique
T1555
Credentials from Password Stores
TA0007
Discovery
3 techniques
T1033
System Owner/User Discovery
T1082
System Information Discovery
T1614
System Location Discovery
TA0008
Lateral Movement
2 techniques
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1021.002×2
SMB/Windows Admin Shares
T1021.004
SSH
T1570
Lateral Tool Transfer
TA0009
Collection
3 techniques
T1074×4
Data Staged
T1074.001
Local Data Staging
T1213
Data from Information Repositories
T1560
Archive Collected Data
TA0011
Command and Control
2 techniques
T1071
Application Layer Protocol
T1105×2
Ingress Tool Transfer
TA0010
Exfiltration
5 techniques
T1030
Data Transfer Size Limits
T1041
Exfiltration Over C2 Channel
T1048
Exfiltration Over Alternative Protocol
T1537×2
Transfer Data to Cloud Account
T1567
Exfiltration Over Web Service
T1567.002
Exfiltration to Cloud Storage
TA0040
Impact
5 techniques
T1486×27
Data Encrypted for Impact
T1489×3
Service Stop
T1490
Inhibit System Recovery
T1498
Network Denial of Service
T1657×5
Financial Theft
IOCS

Observables

18 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping44

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables18

Domains, IPs, and hashes tied to this actor, refreshed continuously.