DarkSide was a ransomware-as-a-service operation whose software was used in a May 2021 attack on a US pipeline company's IT network. CISA and the FBI published advisory AA21-131A describing it. Their advice was practical: multifactor authentication on remote access, restricted RDP, tested offline backups, patching and IT to OT segmentation.
What did the advisory report?
In the advisory, CISA and the FBI said they were aware of a ransomware attack affecting a critical infrastructure entity, a pipeline company, in the United States. Actors deployed DarkSide ransomware against the company's IT network. The company reported that it proactively disconnected certain operational technology systems for safety, and the agencies said there was no indication that the actors moved laterally into OT.
That distinction matters. The attack hit business systems. The disruption came from a decision to isolate operations as a precaution, which shows why the link between IT and OT is a risk even when it is not breached.
What does ransomware-as-a-service mean?
The advisory describes DarkSide as ransomware-as-a-service. The developers receive a share of the proceeds from the criminal actors, called affiliates, who deploy it. The split of work explains why defenders see different intrusion methods under one name: the affiliate chooses how to get in, and the developer supplies the encryption and payment tooling.
Per open-source reporting cited in the advisory, affiliates had been observed gaining initial access through phishing and by exploiting remotely accessible accounts and systems, including virtual desktop infrastructure. The advisory maps these to MITRE ATT&CK techniques: Phishing (T1566), Exploit Public-Facing Application (T1190) and External Remote Services (T1133).
What technical details did CISA share?
CISA's analysis of a sample variant found that it executed a DLL used to delete Volume Shadow Copies, which removes a common local recovery option. The malware also collected and sent system information to command and control domains. The actors were observed using Tor for command and control and, in some cases, Cobalt Strike.
Indicator files were published for defenders. Those indicators age quickly, so treat them as a historical record rather than a current blocklist.
Which mitigations did the agencies urge?
The list is short enough to act on:
- Require multifactor authentication for remote access.
- Filter phishing emails and executable attachments, and train users.
- Update software in a timely way, using a risk-based approach.
- Limit RDP, restrict the source addresses and require multifactor authentication if it is needed.
- Disable Office macros in emailed documents and use application allowlisting.
- Monitor or block inbound connections from Tor exit nodes where not expected.
- Segment IT from OT, with a controlled zone between them, and test manual operating procedures.
- Back up frequently, test restores, and store backups separately from network connections that could let ransomware reach them.
What is the lesson now?
The group name is less useful than the pattern. Remote access without strong authentication, flat networks and untested backups appear in advisory after advisory. The controls above were reasonable in 2021 and remain so.
A constructed example: a small manufacturer lists its internet-facing services and finds a remote desktop gateway with password-only sign-in, used by two contractors. They enable multifactor authentication, restrict source addresses to the contractors' offices, and move backups to a separate account with a different login. Those three changes address the entry point, the spread and the recovery in one afternoon.
How to check or apply this
- Inventory every remote access path and confirm multifactor authentication on each.
- Scan your public address space for exposed RDP and remote desktop gateways.
- Do a restore test from your oldest and newest backup, and time it.
- Confirm backups cannot be deleted from a normal admin account.
- Map the connections between IT and any operational systems, and write down how to run manually.
- Rehearse a tabletop exercise: who decides to isolate, and who calls whom.
Quick check
Did DarkSide attack the pipeline's operational systems directly?
According to CISA and the FBI, the ransomware was deployed against the company's IT network, and there was no indication that the actors moved laterally to OT systems. The company reported that it disconnected certain OT systems as a precaution.
Are the 2021 indicators still useful?
Mostly as history. Attackers change infrastructure often, so focus on the controls that block the techniques.
Sources
Last reviewed: 18 October 2026.
