Lessons Learned from Telemetry Analysis of Dark Side Affiliate Exfiltration Operations
Summary: Dragos used Team Cymru internet traffic telemetry to identify a DarkSide affiliate's stolen-data repository on a leased VPS, where data from Colonial Pipeline and other victims was staged via SFTP over SSH port 22, with the campaign beginning in the last week of April 2021. On 07 May 2021, roughly eleven hours after about 95-120GB was uploaded in under two hours, Dragos observed connections from inside Colonial Pipeline's network to external Tor relays on port 443, continuing intermittently until 17:43 UTC on 08 May 2021.
Bottom line: About 100 gigabytes left the network for a single destination in under two hours, and the same operator reached two Brenntag subsidiaries more than 2,700 kilometers apart through trusted connections between them; Bloomberg and Bleeping Computer later reported ransoms of roughly $5 million and $4.4 million.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026