Ransom Ledger

DarkSide

Also known as BlackMatter (successor)

An affiliate's attack on Colonial Pipeline made it the most wanted ransomware brand in the world within a week. It announced its own closure in May 2021, and the FBI clawed back most of Colonial's payment.

What it is
Ransomware-as-a-service
Based
Russian-speaking
Active
2020–2021
Status
Defunct

On the record

  1. Jun 2021 · CyberScoop

    The Justice Department seizes 63.7 bitcoin of the Colonial ransom

  2. May 2021 · Dark Reading

    Colonial Pipeline's CEO confirms the company paid $4.4 million

In the ledger

$4.4 million paid in the one payment listed

  • May 2021Colonial Pipeline paid $4.4 million. Confirmed by the victim.

One outage listed

  • May 2021Colonial Pipeline: 5 days offline. The pipeline halted on 7 May and restarted on 12 May 2021.
Petrol pumps wrapped in yellow caution tape at a Wawa station
Taped-off pumps at a Wawa in Fairfax County, Virginia, on 15 May 2021, after panic buying emptied the tanks. Photo: Famartin, CC BY-SA 4.0.