DarkSide, the ransomware group behind the Colonial Pipeline attack, has apparently lost access to its website and servers.
On Thursday, the operator of DarkSide wrote in a Russian forum about losing access to the group’s “public infrastructure,” according to cybersecurity company Recorded Future, which spotted the forum post.
Lost assets include the group's blog, which has been down since Thursday, and its payment server, which has been receiving cryptocurrency funds from victims.“A few hours after the withdrawal, funds from the payment server (ours and clients) were sent to an unknown address,” DarkSide operator “Darksupp” wrote in the post.
The statement suggests law enforcement has been seizing the group’s IT infrastructure. On the same day Darksupp reported losing the access, President Biden said the US would “pursue a measure to disrupt” the ransomware group’s ability to operate.
Biden has also called on Russia—where US intelligence believes the DarkSide group is based— to hunt down the attackers. “We have been in direct communication with Moscow about the imperative for responsible countries to take decisive action against these ransomware networks,” Biden said.
The US scrutiny may have also caused the entire cybercriminal underworld to shun the DarkSide group. “As of May 14, several credible underground sources have claimed that the DarkSide ransomware group no longer has a presence on the dark web,” cybersecurity company Gemini Advisory wrote in a blog post.
“One of the top-tier forums on which DarkSide operated has imposed sanctions against all ransomware groups, banning them from the forum entirely,” Gemini Advisory added. “The other top-tier forum deleted the account darksupp and two threads about its ransomware.”
Dmitry Smilyanets, a Recorded Future researcher, adds that a separate ransomware group known as Revil claims DarkSide is no more. However, Smilyanets cautions this could merely be a “false flag.” It’s entirely possible DarkSide has deliberately chosen to lay low with the goal of re-emerging months later under a different name.