MITRE ATT&CK G0128
DarkSide
View MITRE Group Page ↗
Aliases: BlackMatter, ALPHV Affiliate
Official Attribution Source: CISA Advisory AA21-131A & DOJ Forfeiture Actions
Key Facts
Jurisdiction
Russian Federation
Geographic origin
Cases
1
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
- Attributed Country: Russian Federation.
- ATT&CK Group Reference: G0128 (DarkSide).
- Linked to 1 primary court prosecution record(s) with $4.4 million documented loss.
- Identified 0 individually charged operative(s) and 0 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1078 Valid Accounts | 1 incidents |
| T1486 Data Encrypted for Impact | 1 incidents |
| T1041 Exfiltration Over C2 Channel | 1 incidents |
| T1021.001 Remote Desktop Protocol | 1 incidents |
Prosecution Cases Attributed to DarkSide
Colonial Pipeline DarkSide Ransomware Attack
pleaded 2021-05-07
DarkSide ransomware extortion against the largest refined petroleum pipeline system in the United States, forcing the shutdown of 5,500 miles of fuel pipelines and triggering widespread East Coast fuel shortages.
Primary Attack Mechanism: A single compromised employee password found on a dark web breach compilation for an inactive legacy Virtual Private Network (VPN) account that lacked multifactor authentication (MFA).
4 techniques mapped · Loss: $4.4 million
View full case dossier →
Documented TTP Signature for DarkSide
Test Controls in Stack Audit →T1078: Valid Accounts
Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
T1486: Data Encrypted for Impact
Adversaries encrypt victim files and databases to disrupt business operations and demand financial extortion.
T1041: Exfiltration Over C2 Channel
Adversaries transmit stolen data over existing command and control channels back to adversary servers.
T1021.001: Remote Desktop Protocol
Adversaries use Remote Desktop Protocol (RDP) connections to log into target systems interactively.