Dark Side Ransomware Gang Quits After Servers, Bitcoin Stash Seized
Summary: The DarkSide ransomware affiliate program behind the six-day Colonial Pipeline outage announced it was closing after its servers were seized and cryptocurrency was drained from an account used to pay affiliates, according to a message reposted to a Russian OSINT Telegram channel. The group said it was releasing decryption tools for ransomed companies that had not yet paid, while a REvil representative said that platform would bar attacks on healthcare, educational and government organizations and require approval before infecting victims.
Key Takeaway: Intel 471 assessed that the operators are more likely retreating from the spotlight than reforming, and that many will resurface under new names and variants - so the affiliate infrastructure behind Colonial Pipeline has not disappeared, it has gone quiet.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026