Article
Ransomware examples: attacks, types and groups
Ransomware examples explained: five documented attacks, the main types of ransomware and the groups named in recent government advisories.
Read more
Significant cyber incident
Colonial Pipeline ransomware attack (May 2021)
The Colonial Pipeline ransomware attack began on 7 May 2021, when the US petroleum pipeline operator shut down its pipeline system after a DarkSide attack on its IT network.
In short
The Colonial Pipeline ransomware attack began on 7 May 2021, when the US petroleum pipeline operator shut down its pipeline system after a DarkSide attack on its IT network. The FBI confirmed DarkSide on 10 May, and the company restarted its whole system on 13 May. CISA and the FBI saw no sign that the attackers reached operational technology, but gasoline supply problems and emergency measures followed.
What happened
On 7 May 2021, Colonial Pipeline Company shut down its pipeline system on its own initiative after a ransomware attack. The FBI was told of the disruption on 9 May and confirmed on 10 May that DarkSide ransomware was responsible.
CISA and the FBI say the actors deployed DarkSide ransomware against the company’s IT network. The company reported that it disconnected certain OT systems for safety. The agencies saw no sign that the attackers moved into OT systems.
On 13 May 2021 Colonial Pipeline said it had restarted its entire system and deliveries had begun to all markets. In the meantime, US agencies issued fuel waivers, trucking exemptions and a shipping waiver to ease supply. FinCEN later wrote that the attack extorted a multi-million dollar ransom and caused gasoline shortages.
Timeline
-
7 May 2021
Colonial Pipeline shuts down its pipeline system in response to a ransomware attack.
-
9 May 2021
The FBI is notified of the network disruption; the Federal Motor Carrier Safety Administration issues a temporary hours of service exemption.
-
10 May 2021
The FBI confirms DarkSide ransomware is responsible. PHMSA issues an emergency enforcement stay and the FERC Chairman issues a statement on pipeline cyber standards.
-
11 May 2021
CISA and the FBI release joint advisory AA21-131A on DarkSide. EPA issues an emergency fuel waiver and DOT outlines its efforts to ease supply.
-
12 May 2021
The Secretary of Homeland Security approves a temporary Jones Act waiver for East Coast oil supply.
-
13 May 2021
Colonial Pipeline announces it has restarted its entire system and deliveries begin to all markets.
-
27 May 2021
DHS announces the first TSA Security Directive for critical pipeline owners and operators.
-
8 July 2021
CISA and the FBI add malware sample indicators to advisory AA21-131A and note the sample is not linked to the pipeline incident.
-
20 July 2021
DHS announces the second TSA Security Directive for critical pipelines.
-
21 September 2021
The US Treasury announces actions against ransomware and says 2020 payments passed 400 million dollars.
How the attack worked
Initial access
The advisory does not say how the attackers got in. It says DarkSide actors have previously gained initial access through phishing and by exploiting remotely accessible accounts, systems and virtual desktop infrastructure. That is general behavior, not a finding about this victim.
Ransomware on the IT network
CISA and the FBI say the actors deployed DarkSide ransomware against the company’s IT network. Per the advisory, DarkSide actors encrypt and steal sensitive data (Data Encrypted for Impact, T1486) and threaten to publish it if the ransom is not paid. DarkSide is run as ransomware-as-a-service: developers get a share of the proceeds from affiliates who deploy it.
The OT question
The advisory says there was no indication that OT networks were directly affected and no sign the actor moved laterally to OT. The company reported it proactively disconnected certain OT systems for safety. Sources opened do not describe the exact reason for the shutdown beyond this.
- Initial accessMethod not stated for this victim; DarkSide has used phishing and exposed remote accessTechnique T1566 (MITRE ATT&CK, opens in a new tab)
- Ransomware deployedDarkSide ransomware used against the IT network and data encryptedTechnique T1486 (MITRE ATT&CK, opens in a new tab)
- OT disconnectedThe company took certain OT systems offline for safety; no lateral movement seen
- Shutdown and restartPipeline shut down 7 May and restarted 13 May
ATT&CK techniques
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the FBI, 10 May 2021: the DarkSide ransomware is responsible for the compromise of the Colonial Pipeline networks (as reported on the US Department of Energy page). CISA and the FBI, joint advisory AA21-131A, 11 May 2021: DarkSide actors deployed the ransomware. DarkSide is a ransomware-as-a-service operation, so the people who ran the attack (affiliates) are not named in the sources opened.
Impact
Colonial Pipeline shut down its pipeline system from 7 May and restarted it on 13 May 2021, per the Department of Energy page.
FinCEN says the attack extorted a multi-million dollar ransom and caused gasoline shortages. Sources opened for this page give no ransom amount.
US agencies issued emergency measures: a trucking hours of service exemption, a PHMSA enforcement stay, EPA fuel waivers, a Jones Act waiver and DOT help for overweight fuel loads.
CISA and the FBI saw no indication that OT networks were directly affected by the ransomware.
Government and regulator response
- 7 May 2021: the company shut down its pipeline system and reported it disconnected certain OT systems for safety.
- 9 to 12 May 2021: the Department of Energy activated its Energy Response Organization. DOT, FMCSA, PHMSA, EPA and DHS issued exemptions, stays and waivers to ease fuel supply.
- 10 May 2021: the FBI confirmed DarkSide. 11 May: CISA and the FBI published advisory AA21-131A with mitigations, including IT and OT segmentation, multi-factor authentication and offline backups.
- 13 May 2021: the company restarted its entire pipeline system.
- 27 May 2021: TSA’s first Security Directive required incident reporting to CISA, a 24/7 Cybersecurity Coordinator and a practice review within 30 days.
- 20 July 2021: TSA’s second Security Directive required ransomware mitigations, a recovery plan and an architecture design review.
Lessons
-
Plan for IT trouble to stop operations
The company shut its pipeline down after the IT attack, even though CISA and the FBI saw no sign OT was directly affected. Decide in advance when you will isolate OT.
-
Separate IT and OT
CISA and the FBI advise robust network segmentation and a demilitarized zone between IT and OT networks.
-
Test manual controls
The advisory tells operators to test manual controls regularly so critical functions can continue if OT must be taken offline.
-
Keep offline backups
CISA and the FBI say ransomware tries to encrypt or delete reachable backups, so keep tested copies isolated from the network.
-
Lock down remote access
The advisory recommends multi-factor authentication for remote access and restricting RDP.
-
Expect regulation after a major event
TSA issued two mandatory Security Directives for pipelines within about two months of the attack.
What to check in your own organization
-
IT and OT separation
Confirm which OT functions depend on IT systems, and whether a DMZ filters traffic between them.
-
Shutdown decision
Write down who can decide to take OT systems offline after an IT incident, and test the manual operating plan.
-
Remote access
List every remote access path, require multi-factor authentication and restrict or remove RDP.
-
Backups
Check that critical system backups are offline, tested and not reachable from the production network.
-
Tor and anonymizers
Check whether inbound connections from Tor exit nodes are monitored or blocked where no external access is expected.
-
Incident reporting
If you run a pipeline or similar critical asset, check your duties under TSA directives and name a 24/7 coordinator.
-
Email filtering
Check spam filtering, macro controls and phishing training, since DarkSide has used phishing in other cases.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country United States This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America
Questions
Who attacked Colonial Pipeline?
The FBI confirmed on 10 May 2021 that DarkSide ransomware was responsible. DarkSide works as ransomware-as-a-service, so the affiliate behind the attack is not named in the sources opened.
Did the attack reach operational systems?
CISA and the FBI saw no indication that OT networks were directly affected or that the actor moved laterally to OT. The company disconnected certain OT systems for safety.
How long was the pipeline down?
The company shut down on 7 May 2021 and said on 13 May 2021 it had restarted its entire system.
How did the attackers get in?
Sources opened do not say. The advisory only lists methods DarkSide has used before, such as phishing and exposed remote access.
Was a ransom paid?
FinCEN says the attack extorted a multi-million dollar ransom. The amount is not given in sources opened for this page.
What changed afterwards?
TSA issued two Security Directives for pipeline owners and operators, on 27 May and 20 July 2021.
In our research
- Ransomware examples: attacks, types and groups October 2026
- Protecting Critical Infrastructures with Advanced Digital Risk Monitoring March 2025
- Ransomware recovery and detection: a practical guide July 2024
- DarkSide Ransomware Technical Analysis Open Report July 2023
- YES! Ransom Gangs Retarget Same Companies, Learn Why! October 2022
Sources
- Colonial Pipeline Cyber Incident US Department of Energy
- DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks (AA21-131A) CISA and FBI
- DHS Announces New Cybersecurity Requirements for Critical Pipeline Owners and Operators (27 May 2021) US Department of Homeland Security
- DHS Announces New Cybersecurity Requirements for Critical Pipeline Owners and Operators, Second Security Directive (20 July 2021) US Department of Homeland Security
- Financial Trend Analysis: Ransomware Trends in Bank Secrecy Act Data FinCEN, US Treasury
- Treasury Takes Robust Actions to Counter Ransomware US Department of the Treasury
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.