{
  "family": "darkside",
  "sample_count": 75,
  "category": "ransomware",
  "description": "DarkSide is a notorious Ransomware-as-a-Service (RaaS) operation that surfaced in August 2020, achieving global infamy in May 2021 following its catastrophic cyberattack against Colonial Pipeline, which forced the shutdown of the largest refined oil pipeline system in the United States and triggered a regional state of emergency across the East Coast. Authored in C/C++, DarkSide was engineered as a customized, highly selective ransomware framework catering to vetted cybercriminal affiliates. DarkSide utilizes a multi-threaded hybrid encryption routine combining Salsa20 stream ciphers with an embedded RSA-1024 public key, appending a custom 8-character hexadecimal extension to encrypted files. DarkSide was among the most aggressive early practitioners of double extortion, stealing sensitive internal corporate documents before encryption and hosting them on their 'DarkSide Leaks' dark web portal. Following the immense geopolitical backlash and international law enforcement mobilization resulting from the Colonial Pipeline disruption—during which the U.S. Department of Justice recovered $2.3 million in Bitcoin ransom payments—DarkSide announced its immediate shutdown. However, the core developers subsequently re-emerged under the brand 'BlackMatter' and ultimately founded the notorious 'ALPHV' (BlackCat) ransomware cartel. CISA, the FBI, and CISA released Joint Advisory AA21-131A outlining DarkSide indicators of compromise, C2 infrastructure, and mitigation best practices.",
  "cta": "Published by the SystemHelpdesk threat intelligence team.",
  "aliases": [
    "DarkSide Ransomware",
    "DarkSide.Leaks",
    "Trojan.Ransom.DarkSide",
    "Win32/DarkSide",
    "BlackMatter-Precursor"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is DarkSide ransomware and what was its most infamous attack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DarkSide was a Russian-speaking RaaS group that launched the May 2021 attack on Colonial Pipeline, which forced the shutdown of major fuel delivery across the eastern United States."
      }
    },
    {
      "@type": "Question",
      "name": "How did DarkSide evolve into BlackMatter and ALPHV/BlackCat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Following intense law enforcement pressure after the Colonial Pipeline attack, DarkSide rebranded as BlackMatter in July 2021 and subsequently evolved into the Rust-based ALPHV/BlackCat syndicate."
      }
    },
    {
      "@type": "Question",
      "name": "What encryption algorithms did DarkSide employ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DarkSide utilized the Salsa20 symmetric stream cipher to encrypt file contents and RSA-1024 to encrypt the per-file keys, appending unique victim extensions."
      }
    },
    {
      "@type": "Question",
      "name": "Did U.S. law enforcement recover the ransom paid to DarkSide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, in June 2021, the FBI and U.S. Department of Justice successfully seized 63.7 bitcoins (valued at approximately $2.3 million) from DarkSide's affiliate cryptocurrency wallet."
      }
    },
    {
      "@type": "Question",
      "name": "What mitigations are recommended in CISA Advisory AA21-131A?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce multi-factor authentication on all remote access and VPN services, patch critical vulnerabilities like PrintNightmare, implement robust network segmentation, and maintain offline, immutable backups."
      }
    },
    {
      "@type": "Question",
      "name": "What specific initial access vector enabled the Colonial Pipeline intrusion by DarkSide affiliates?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The May 2021 Colonial Pipeline attack was executed via a single compromised legacy Virtual Private Network (VPN) account that lacked multi-factor authentication (MFA). Threat actors obtained the employee credentials from a dark web credential leak, logged into the corporate network over the VPN, and subsequently escalated privileges to deploy DarkSide ransomware across IT operational systems."
      }
    },
    {
      "@type": "Question",
      "name": "How did the DarkSide syndicate rebrand into BlackMatter and eventually ALPHV/BlackCat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Following intense international law enforcement pressure and the seizure of its server infrastructure after the Colonial Pipeline incident, DarkSide announced its shutdown in May 2021. Within months, the core developers resurfaced under the name BlackMatter. After BlackMatter was cracked by Emsisoft researchers, the group re-architected its platform in the Rust programming language, launching ALPHV (BlackCat) in November 2021."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1486",
    "T1490",
    "T1021.002",
    "T1059.001",
    "T1041",
    "T1562.001",
    "T1003.001"
  ],
  "cisa_advisory": "AA21-131A",
  "exploited_cves": [
    "CVE-2021-34527"
  ],
  "iocs": {
    "file_hashes": [
      "4a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c1",
      "1025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737be70d8a57",
      "e70d8a571025b508f72a4209bf270b8a098b671a52028ddc87c14a22ad31737b"
    ],
    "delivery": [
      "Compromised virtual private network (VPN) accounts lacking multi-factor authentication",
      "Exploitation of Windows Print Spooler vulnerability CVE-2021-34527 (PrintNightmare)",
      "Cobalt Strike beacons and initial access brokers staging DarkSide payloads"
    ],
    "persistence": [
      "Service installation with randomized naming under Windows Service Control Manager",
      "Scheduled task execution under system accounts to bypass UAC prompts",
      "Temporary staging in %APPDATA% before enterprise domain execution"
    ]
  },
  "lineage": {
    "derived_from": [],
    "variants": [
      "darkside_v1",
      "darkside_v2",
      "blackmatter",
      "alphv_blackcat"
    ]
  },
  "ecosystem": [
    "windows",
    "linux",
    "vmware_esxi"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "privilege_escalation",
    "defense_evasion",
    "lateral_movement",
    "exfiltration",
    "impact"
  ],
  "last_updated": "2026-10-16",
  "sources": [
    {
      "name": "CISA Advisory AA21-131A: DarkSide Ransomware",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-131a"
    },
    {
      "name": "U.S. Department of Justice: Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to Ransomware Extortionists Darkside",
      "url": "https://www.justice.gov/opa/pr/department-justice-seizes-23-million-cryptocurrency-paid-ransomware-extortionists-darkside"
    },
    {
      "name": "Mandiant: Shining a Light on DarkSide Ransomware Operations",
      "url": "https://www.mandiant.com/resources/blog/shining-a-light-on-darkside-ransomware-operations"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}