DarkSide
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 26 incidents
- Sources
- 18 sources
- First seen
- 2020-01-09
- Last seen
- 2023-06-06
- Updated
- 2026-10-10 19:22
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
DarkSide, also tracked as BlackMatter, is a ransomware‑as‑a‑service (RaaS) operation believed to operate from Russia. The group has targeted a wide range of sectors including energy (Colonial Pipeline), chemical distribution (Brenntag), agriculture (NEW Cooperative), media software (Marketron), medical technology (Olympus), retail (Guess, Home Hardware, BLK Sport), insurance (One Call), electronics (Toshiba Tec), real estate (Brookfield Residential), and banking (Banca di Credito Cooperativo), primarily in the United States and Europe. Its strategic objective is financial gain through ransomware encryption and double‑extortion threats to leak stolen data. Observed tactics include gaining initial access via compromised credentials, deploying custom encryption routines identical to those used by DarkSide, exfiltrating data before encryption, and publishing victim data on a Tor‑hosted leak site to pressure payment. BlackMatter is publicly described as a rebrand of the DarkSide operation that ceased activity after the Colonial Pipeline attack under law‑enforcement pressure; no state nexus is explicitly stated in the source material. Notable campaigns include the May 2021 Colonial Pipeline shutdown, the $4.4 million ransom paid by Brenntag, the $5.9 million demand against NEW Cooperative, and ransomware incidents against Marketron, Olympus, Guess, One Call, Toshiba Tec, Brookfield Residential, and Banca di Credito Cooperativo.
Incidents
Attributed incidents are available to members.
26 incidentsSources
Sources available to members: 18 sources.