The outage of one of the main fuel pipelines in the U.S. is into its third day as a result of a cyberattack. According to sources close to the investigation, the attack was carried out by cybercriminals known as DarkSide.
DarkSide has a Robin Hood image - stealing from businesses and donating a portion to charity.
Colonial described the intrusion as a ransomware attack, in which hackers usually lock up computer systems by encrypting data, paralyzing networks and then demanding a ransom to unscramble it.
DarkSide is one of the ransomware groups that have "professionalized" a criminal enterprise that has cost governments tens of billions of dollars in damages over the last three years.
Their website includes a hall of shame gallery of leaked data from victims that haven't paid - selling stolen documents from more than 80 businesses in the U.S. and Europe.
DarkSide says that they don't target medical, educational or government institutions - but only large businesses. A portion of their profits is donated to charity. However, cybersecurity experts said the group appeared to be made up of seasoned cyber criminals intent on extracting as much money as possible.
"They're very new but they're very organized," Lior Div, the chief executive of security firm Cybereason, said.
Though DarkSide is not the largest gang of its type the incident demonstrates the growing threat that ransomware poses to vital industrial infrastructure and not just business. It also signifies the emergence of an insidious criminal IT ecosystem worth tens of millions of dollars, unlike anything seen in the cybersecurity industry before.
