Article
DarkSide Ransomware Technical Analysis Open Report
Technical analysis of DarkSide ransomware: how the RaaS group operates, its double extortion model, how it infects systems, plus detections and IoCs.
Read more
Ransomware group profile
DarkSide
Also known as Darkside, BlackMatter (possible rebrand)
DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S.
- Inactive
In short
DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S. pipeline company's IT network. A later advisory (AA21-291A, October 18, 2021) says it was active from September 2020 through May 2021 and that BlackMatter is a possible rebrand.
- StatusInactiveas reported
- Other Names2names in public reportsDarkside · BlackMatter (possible rebrand)
- Entry Routes3ways inPhishing · Remote Desktop Protocol
- Techniques4mapped to MITRE ATT&CKData Encrypted for Impact · External Remote Services
- Defences7first steps listedSeparate IT from OT · Test manual controls
Overview
DarkSide was a ransomware as a service (RaaS) group. In a RaaS, the developers write the ransomware and receive a share of the proceeds from affiliates who deploy it. CISA and the FBI say that, per open-source reporting, DarkSide actors have targeted multiple large, high-revenue organizations since August 2020. The later BlackMatter advisory gives DarkSide’s active period as September 2020 through May 2021.
The pipeline attack
On May 11, 2021 CISA and the FBI published AA21-131A. It says DarkSide ransomware was deployed against a pipeline company’s information technology (IT) network. There was no indication that the operational technology (OT) networks, which run physical equipment, were directly affected. The company said it disconnected some OT systems to keep them safe. The company is Colonial Pipeline, covered in our incident profile.
- August 2020Targeting beginsAA21-131A cites open-source reporting of large-organization targeting from this month.
- September 2020Active period startsAA21-291A dates DarkSide activity from this month.
- May 8, 2021Ransom paidThe Department of Justice says a ransom payment was made to DarkSide on this date.
- May 11, 2021Advisory publishedCISA and the FBI release AA21-131A.
- May 2021Active period endsAA21-291A says DarkSide was active through this month.
- June 7, 2021Funds seizedThe Department of Justice seizes 63.7 bitcoin linked to the ransom.
- July 2021BlackMatter appearsAA21-291A says BlackMatter was first seen this month.
- October 18, 2021BlackMatter advisoryCISA, the FBI and the NSA publish AA21-291A.
What makes it distinct
DarkSide publicly said it avoided hospitals, schools, non-profits and governments and aimed at organizations that could afford large ransoms. CISA notes that the group used Cobalt Strike, a tool attackers use to control a network, and Tor for command and control. Entry came by phishing and by exposed remote accounts and systems, including Virtual Desktop Infrastructure (VDI).
Law enforcement action
On June 7, 2021 the Department of Justice announced it had seized 63.7 bitcoin, then worth about 2.3 million US dollars. These funds were traced to the ransom paid on May 8. The victim had paid about 75 bitcoin. Investigators followed the transfers on the public Bitcoin ledger. The Department credited the victim for telling the FBI quickly.
The BlackMatter link
AA21-291A, from CISA, the FBI and the NSA, calls BlackMatter a possible rebrand of DarkSide. Since July 2021, it says, BlackMatter has targeted multiple U.S. critical infrastructure entities, including two Food and Agriculture Sector organizations. Ransom demands ranged from 80,000 to 15 million US dollars in Bitcoin and Monero. BlackMatter used a separate Linux encryptor, routinely encrypted ESXi virtual machines and wiped or reformatted backups. The agencies use the word “possible”, so treat the link as likely but not confirmed.
- Main advisory
- AA21-131A, May 11, 2021
- Active period
- September 2020 to May 2021 (AA21-291A)
- Model
- Ransomware as a service
- Possible successor
- BlackMatter (AA21-291A)
- Funds seized
- 63.7 bitcoin, June 7, 2021 (Department of Justice)
- Named in
- FinCEN’s list of the most reported variants
Also known as
- Darkside
- BlackMatter (possible rebrand)
How they get in
-
01
Phishing
AA21-131A says DarkSide actors have been observed gaining initial access through phishing.
-
02
Exposed remote accounts and systems
Actors exploited remotely accessible accounts and systems and Virtual Desktop Infrastructure. The advisory lists Exploit Public-Facing Application and External Remote Services.
-
03
Remote Desktop Protocol
CISA says DarkSide actors used RDP to maintain persistence after getting in.
How they extort
Double extortion, per CISA and the FBI: data is encrypted and stolen, then the actors threaten to release it if the ransom is not paid. The group publicly said it preferred organizations able to pay large ransoms over hospitals, schools, non-profits and governments.
Who they target
-
01
Energy and pipelines
See the industry page -
02
Food and agriculture (BlackMatter)
-
03
Large, high-revenue organizations across sectors
Tools and malware
Techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
Notable incidents
How to defend
-
Require multifactor authentication for remote access
Apply it to both OT and IT network access, per CISA and the FBI.
-
Separate IT from OT
Build robust segmentation between IT and OT networks so an IT compromise cannot easily reach OT.
-
Test manual controls
Regularly test manual controls so critical functions can run if OT networks must be taken offline.
-
Back up and isolate
Run regular backups on both IT and OT networks, test them, and keep them isolated from network connections that could spread ransomware.
-
Restrict RDP
If RDP is needed, limit the source addresses and require multifactor authentication.
-
Filter email and update software
Use strong spam filters, and update operating systems, applications and firmware in a timely way.
-
Watch for Tor and Cobalt Strike
Monitor or block inbound connections from Tor exit nodes where none are expected, and detect connections from Cobalt Strike servers.
Questions
What was DarkSide ransomware?
DarkSide was a ransomware as a service group. Developers write the ransomware and receive a share of the proceeds from affiliates who deploy it. CISA and the FBI named it in advisory AA21-131A, published May 11, 2021.
Who was behind the Colonial Pipeline attack?
CISA and the FBI say DarkSide ransomware was deployed against a pipeline company's IT network, as set out in AA21-131A. The agencies saw no sign that the operational technology networks were directly affected, though the company disconnected some OT systems.
How did DarkSide get into networks?
Per CISA and the FBI, DarkSide actors used phishing and exploited exposed remote accounts and systems, including Virtual Desktop Infrastructure. They also used Remote Desktop Protocol to stay in the network after getting access.
What is the link between DarkSide and BlackMatter?
Advisory AA21-291A from CISA, the FBI and the NSA calls BlackMatter a possible rebrand of DarkSide. The agencies use the word possible, so the link is likely but not confirmed.
How can organizations defend against DarkSide-style ransomware?
CISA and the FBI advise multifactor authentication for remote access, separating IT from OT networks, testing manual controls, and keeping tested backups isolated from the network. Limit and protect RDP, filter email and update software promptly.
In our research
- DarkSide Ransomware Technical Analysis Open Report July 2023
- Ransomware examples: attacks, types and groups October 2026
- Why Does Ransomware Still Threaten Cybersecurity? June 2025
- Protecting Critical Infrastructures with Advanced Digital Risk Monitoring March 2025
- Ransomware Royale: The Cyber Heist You Can’t Afford to Ignore September 2024
- Pandora Ransomware Technical Analysis Report November 2023
Sources
- DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks (AA21-131A) CISA, FBI
- BlackMatter Ransomware (AA21-291A) CISA, FBI, NSA
- Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists DarkSide U.S. Department of Justice
- Financial Trend Analysis: Ransomware FinCEN
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.