What is DarkSide Ransomware?

DarkSide Ransomware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Large enterprises; stolen-access affiliates

Source Attribution

Origin: MITRE
Source: FBI · CISA
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: FBI · CISA · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2020-08 discovered DarkSide first observed
2021-05 exploited Colonial Pipeline ransomware attack
2021-05 updated Operations shut down

Quick Answer

DarkSide affiliates use RDP compromise and targeted encryption, publishing data on a leak site; Colonial Pipeline attack triggered its shutdown.

Definition

DarkSide is an RaaS that used purchased network access and was responsible for the Colonial Pipeline attack in May 2021 before shutting down.

Overview

DarkSide is an RaaS that used purchased network access and was responsible for the Colonial Pipeline attack in May 2021 before shutting down.

Behavior

Purchased network access
Colonial Pipeline incident
Announced shutdown May 2021

First Seen

2020-08

Target

Large enterprises; stolen-access affiliates

Techniques: T1486, T1078, T1210
Campaigns: colonial-pipeline-darkside
Related CVEs: CVE-2019-19781

Malware Intelligence

Family: DarkSide Ransomware

Aliases: DarkSide

Techniques: T1486, T1078, T1210

Targets: Large enterprises; stolen-access affiliates

Behavior:

Purchased network access
Colonial Pipeline incident
Announced shutdown May 2021

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating DarkSide Ransomware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about DarkSide Ransomware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.