AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks
Key Facts
- Official advisory designation: AA21-131A.
- Published on 2021-05-11 by CISA & FBI.
- Directly correlated with 1 primary case dossier(s) in this library.
- Provides joint government TTPs, MITRE ATT&CK indicators, and prioritized enterprise mitigations.
Related Primary Court Cases & Incident Forensics
Colonial Pipeline DarkSide Ransomware Attack
DarkSide ransomware extortion against the largest refined petroleum pipeline system in the United States, forcing the shutdown of 5,500 miles of fuel pipelines and triggering widespread East Coast fuel shortages.
ATT&CK Techniques Cited in Advisory Matters
"The initial entry vector was a legacy Virtual Private Network account that was active without multifactor authentication using a password discovered in a dark web leak."
"DarkSide ransomware encrypted billing and corporate IT systems within hours, prompting pipeline operators to halt physical fuel transmission as a precaution."
"Adversaries exfiltrated approximately 100 gigabytes of internal corporate documents to cloud servers before deploying encryption routines."
"The DarkSide affiliate logged in via single-factor VPN and established an interactive Remote Desktop session to lateral servers."