President Biden promised a US response to DarkSide yesterday and right now something very bad appears to be happening to DarkSide, which hacked the Colonial Pipeline.
Cybersecurity firm Mandiant says it sees dark web posts claiming DarkSide lost access to its infrastructure, including blog, payment, and servers and will be closing its criminal service service.
Mandiant says the Posts claim decrypters will be provided for companies who have not paid- that is, DarkSide is allegedly telling its affiliates to let its victims off the hook.
Intel471 reports that dark web posts claim DarkSide has promised to compensate outstanding financial obligations to its criminal associates by May 23.
Intel 471 also says posts claim funds from DarkSide cryptocurrency wallets allegedly were exfiltrated- not clear who cleared them out, though.
And Intel 471 also reports the Cryptocurrency mixing service BitMix is reportedly inaccessible this week- that’s important because it’s one way hackers allegedly launder the proceeds of their criminal activity.
No confirmation that the US government is responsible for this.
Couple notes of caution - this could be the result of government action, private sector Cybersecurity action or rival gangs sensing weakness and piling on.
Also - bear in mind that DarkSide may very well want the world to *think* they have gone away, even as they scramble to reconstitute in another format.
Asked if the US government is responsible for this apparent DarkSide takedown, a National Security Council spokesperson tells me now: "unfortunately don’t have anything for you here."
The @NSAGov just responded to my request for comment on all this ... and referred me to the National Security Council, which has already declined to comment.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
