The cyberattack that shut down a major oil pipeline was carried out by a gang that is known to extort corporations and give a cut …
The cyberattack that shut down a major oil pipeline was carried out by a gang that is known to extort corporations and give a cut of the ransoms to charity, a new report said. The Colonial Pipeline, which carries more 100 million gallons of fuel from Texas to the Northeast each day, has been out of service since Friday. Two sources with knowledge of the federal investigation into the attack told The Associated Press that the criminal enterprise known as DarkSide is behind it. DarkSide launched a ransomware attack against Colonial, which involves paralyzing company networks before demanding a large ransom to undo the damage. Colonial on Sunday said it’s developing a “system restart” plan for the pipeline, which delivers about 45 percent of the East Coast’s fuel supply. “We are in the process of restoring service to other laterals and will bring our full system back online only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations,” the company said in a statement. Meanwhile, Commerce Secretary Gina Raimondo said Sunday an “all-hands-on-deck” effort is underway to restore operations. “We are working closely with the company, state and local officials to make sure that they get back up to normal operations as quickly as possible and there aren’t disruptions in supply,” Raimondo said. DarkSide claims that it does not attack hospitals and nursing homes, educational or government targets and that it donates a portion of its take to charity. It has been active since August and, typical of the most potent ransomware gangs, is known to avoid targeting organizations in former Soviet bloc nations. Colonial did not say whether it has paid or was negotiating a ransom, and DarkSide neither announced the attack on its dark web site nor responded to an Associated Press reporter’s queries.
