The FBI and the US Cybersecurity and Infrastructure Security Agency (CISA) have issued a joint advisory in the aftermath of a devastating ransomware attack on Colonial Pipeline.
The alert, published on Tuesday, provides details on DarkSide, malware operators that run a Ransomware-as-a-Service (RaaS) network.
DarkSide is responsible for the recent cyberattack on Colonial Pipeline. Last Friday, the fuel giant said a cyberattack had forced the company to halt pipeline operations and temporarily pull IT systems offline to contain the incident, found to be an infection caused by DarkSide affiliates.
Colonial Pipeline is yet to recover and as a critical infrastructure provider — one of whom supplies 45% of the East Coast’s fuel and which usually delivers up to 100 million gallons of fuel daily — the FBI has become involved.
“Cybercriminal groups use DarkSide to gain access to a victim’s network to encrypt and exfiltrate data,” the alert says. “These groups then threaten to expose data if the victim does not pay the ransom. Groups leveraging DarkSide have recently been targeting organizations across various CI sectors including manufacturing, legal, insurance, healthcare, and energy.”
The DarkSide ransomware is provided to RaaS customers. This cybercriminal model has proven popular as it only requires a core team to develop malware, which can then be distributed to others.
RaaS, also known as ransomware affiliate schemes, may be provided on a subscription basis and/or the creators receive a cut of the profits when a ransom is paid. In return, the developers continue to improve their malware ‘product’.
DarkSide tries to portray itself in a ‘Robin Hood’ light, with terms of service for clients that dictate no medical, care homes, or palliative care providers should be targeted. The operators have been quick to distance themselves from the attack on Colonial Pipeline as a core country fuel provider and vaguely blamed the attack on a partner.
“Our goal is to make money, and not creating problems for society,” DarkSide said.
The FBI/CISA advisory also includes advice and best practices for preventing or mitigating the threat of ransomware.
“CISA and FBI urge CI [critical infrastructure] asset owners and operators to adopt a heightened state of awareness and implement recommendations […] including implementing robust network segmentation between IT and OT networks; regularly testing manual controls; and ensuring that backups are implemented, regularly tested, and isolated from network connections,” the agencies say. “These mitigations will help CI owners and operators improve their entity’s functional resilience by reducing their vulnerability to ransomware and the risk of severe business degradation if impacted by ransomware.”
Other recommendations include:
- Multi-factor authentication for remote access to IT networks
- Spam filters to mitigate phishing, network traffic filters
- Employee training programs
- Frequent patch processes
- Implementing security audits, risk assessment
- RDP restrictions
- Anonymization service connection monitoring
“CISA and the FBI do not encourage paying a ransom to criminal actors,” the agencies added. “Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or may fund illicit activities. Paying the ransom also does not guarantee that a victim’s files will be recovered.”
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0
