Malware attack on US pipeline linked to DarkSide criminal group

10 May 2021, 06:54

Pipeline with access bridge above it
Michigan Pipeline Canada Conundrum. Picture: PA

The federal government is helping to resolve the worst cyber attack on critical infrastructure in the country’s history.

The cyber attack which shut down a vital US pipeline was carried out by a criminal group known as DarkSide that cultivates a Robin Hood image of stealing from corporations and giving a cut to charity.

The information comes from two people close to the investigation who spoke on condition of anonymity, as the the temporary halting of operations on the the pipeline that carries gasoline and other fuel from Texas to the north-east coast stretched into a third day.

President Joe Biden’s administration says an “all-hands-on-deck” effort is underway to restore operations and avoid disruptions in the energy supply.

Biden
Joe Biden has tasked the US Department of Energy with resolving the crisis (Patrick Semansky/AP)

Experts said that gasoline prices are unlikely to be affected if the pipeline is back to normal in the next few days but that the incident — the worst cyberattack to date on critical US infrastructure — should serve as a wake-up call to companies about the vulnerabilities they face.

The pipeline, operated by Georgia-based Colonial Pipeline, delivers roughly 45% of fuel consumed on the East Coast, according to the company.

It was hit by what Colonial called a ransomware attack, in which hackers typically lock up computer systems by encrypting data, paralysing networks and then demand a large ransom to unscramble it.

On Sunday, Colonial Pipeline said it was actively in the process of restoring some of its IT systems.

It said it remains in contact with law enforcement and other federal agencies, including the Department of Energy, which is leading the federal government response. The company has not said what was demanded or who made the demand.

But two people close to the investigation, speaking on condition of anonymity, identified the culprit as DarkSide.

It is among ransomware gangs that have “professionalised” a criminal industry that has cost Western nations tens of billions of dollars in losses in the past three years.

DarkSide claims that it does not attack hospitals and nursing homes, educational or government targets and that it donates a portion of its take to charity.

It has been active since August and, typical of the most potent ransomware gangs, is known to avoid targeting organizations in former Soviet bloc nations.

Colonial did not say whether it has paid or was negotiating a ransom, and DarkSide neither announced the attack on its dark web site nor responded to an Associated Press reporter’s queries.

The lack of acknowledgment usually indicates a victim is either negotiating or has paid.

On Sunday, Colonial Pipeline said it is developing a “system restart” plan. It said its main pipeline remains offline but some smaller lines are now operational.

By Press Association

Latest World News

See more Latest World News

Video footage shows the convoy had emergency lights flashing when it was hit

Israel admits ‘mistakenly’ killing 15 aid workers after video leak contradicted official version of events

Jaguar Land Rover has paused shipments to the US in the wake of 'Liberation Day' tariffs

Jaguar Land Rover halts shipments to US in wake of tariffs as Trump insists he'll win 'economic revolution'

Flowers and toys left on a swing seat to commemorate victims killed in Russia's missile attack on Friday

Death toll from Russian strike on Zelenskyy's home town rises as 18 confirmed dead - including nine children

Donald Trump's 10% tariff on UK products has officially come into force

Trump tariffs come into force as global stock markets plunge deeper into the red

Tom Howard

British tourist killed after being struck by boulder on trek through Himalayas

In this photo provided by the Ukrainian Emergency Service, a car burns following a Russian missile attack that killed more than a dozen people, including children, in Kryvyi Rih, Ukraine, Friday, April 4, 2025. (Ukrainian Emergency Service via AP)

Russia kills 16 people including three children in missile strike on Zelenskyy's home town, with dozens wounded

Travel influencer Mykhailo Viktorovych Polyakov, 24, made an illegal visit to North Sentinel Island

Tourist who left Coke for world's most isolated tribe 'could have wiped them all out' - and police 'can't go collect can'

White House weighs in to support ‘censored’ anti-abortion activists in Britain

White House looking to support ‘censored’ anti-abortion activists in Britain

This image provided by NASA shows Nick Hague, right, Suni Williams, and Butch Wilmore. (NASA via AP)

Stranded NASA astronauts reveal they were almost trapped in space 'forever' after horror malfunction

Donald Trump demands France 'free Marine Le Pen'

Donald Trump demands France 'free Marine Le Pen' after far-right leader found guilty of embezzlement in 'witch hunt'

China will impose a 34% retaliatory tariff on imports from the US

China announces additional 34% tariffs on US imports in retaliation over Trump's 'Liberation Day' levies

Friends of Prince Andrew say he's "unsurprised" Giuffre made the post

Prince Andrew 'not surprised' his accuser shared shock post saying she had 'four days to live'

South Korea's impeached President Yoon Suk Yeol

South Korea president Yoon Suk Yeol removed from office as impeachment upheld over martial law declaration

Virginia Giuffre

Woman driving Prince Andrew accuser Virginia Giuffre during crash that left her with 'four days to live' breaks silence

Exclusive
'Donald Trump has made Putin comfortable,' Mikhail Khodorkovsky has warned

'Trump has made Putin comfortable' despite massive Ukraine war losses, exiled former oligarch tells LBC

The bodies of Andrew Searle and his wife Dawn were discovered by a neighbour.

British couple found dead in south of France home being ‘treated as murder-suicide’