DarkSide — Ransomware Profile
DarkSide attacked Colonial Pipeline in 2021 causing US fuel supply disruptions, then rebranded to BlackMatter after US pressure.Also tracked as
BlackMatter predecessor
IntelFusions coverage (2)
- NightSpire: The Rbfs Rebrand That Went From Data Theft to Double Extortion in Weeks 2026-02-16 · Ransomware
- TheMoon Botnet Powers Faceless Proxy Service with 40,000 Compromised SOHO Routers Across 88 Countries 2026-02-16 · Cyber Incidents
Tools & malware
- ADRecon Discovery / Active Directory reconnaissance
- Advanced IP Scanner Discovery / network scanning
- AnyDesk Remote access / RMM
- BloodHound Discovery / AD mapping
- Cobalt Strike BEACON Command and control
- DarkSide Ransomware / encryptor
- Mimikatz Credential theft
- NGROK Tunneling / firewall bypass
- PsExec Execution / lateral movement
- Rclone Data exfiltration
- SMOKEDHAM Backdoor
- TeamViewer Remote access / persistence
Vendor research
- Darkside Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks (AA21-131A) CISA / FBI
- Shining a Light on DARKSIDE Ransomware Operations Mandiant
- CARBON SPIDER Embraces Big Game Hunting, Part 2 CrowdStrike
- DarkSide Ransomware Gang: An Overview Unit 42 (Palo Alto Networks)
- DarkSide (Malware Family) Malpedia (Fraunhofer FKIE)