DarkSide

DarkSide was a ransomware-as-a-service (RaaS) operation that emerged in August 2020 and ceased public operations in May 2021. Under the RaaS model, the core developers maintained the malware and leak site while recruited affiliates carried out intrusions, with ransom proceeds split between the two. DarkSide marketed itself with a quasi-corporate ethos, publishing a "code of conduct" that claimed to avoid targeting hospitals, schools, non-profits, and government entities — framing the group as criminals with principles, though researchers treated such claims skeptically.

The group became globally notorious after the 7 May 2021 attack on Colonial Pipeline, the operator of the largest refined-fuel pipeline in the United States. The intrusion led Colonial to shut down pipeline operations for roughly six days, triggering fuel shortages and panic buying across the U.S. East Coast. Colonial paid approximately 75 bitcoin (then about $4.4 million) to the attackers; the U.S. Department of Justice announced on 7 June 2021 that it had recovered about 63.7 bitcoin of that ransom.

The incident prompted significant U.S. policy responses, including President Biden's Executive Order 14028 on improving the nation's cybersecurity (12 May 2021) and a new TSA security directive for pipeline operators. Shortly after the attack, DarkSide's infrastructure — including its leak site and payment servers — went offline, and the operators claimed to have lost access to servers and funds.

Analysts at firms such as Mandiant, Chainalysis, and Recorded Future have linked DarkSide's code base, infrastructure, and personnel to successor brands, most notably BlackMatter (active mid-to-late 2021) and elements of subsequent ransomware operations. DarkSide is widely cited in policy discussions as the case study that elevated ransomware from a criminal nuisance to a recognized national-security and critical-infrastructure threat.