Alpha Team Flash Report: Colonial Pipeline Ransomware Attack Update

Executive Summary

On May 7, 2021, the Colonial Pipeline Company announced that it was the victim of a ransomware attack. In response to the incident and to contain the threat, the company took certain systems offline resulting in a temporary halt of their operations. Numerous reports state that US cybersecurity firm FireEye has been engaged to investigate the nature and scope of the attack, though ZeroFOX does not have any conclusive evidence to confirm or refute this assertion. Law enforcement and other federal agencies were promptly notified and are reportedly working with Colonial Pipeline. While the company’s operations have been restored on May 12, 2021, this incident highlights the potential impact that compromising key infrastructure can have, regardless of early identification of compromise.

Recommendations

The Darkside operators do not have a specific set of data that they target. While on the system, they attempt to exfiltrate any documents or files that seem like they would be important, such as user credentials, financial records, non-disclosure agreements, contracts, network diagrams, and personal information. Segmenting the network and implementing role-based access control is often an effective countermeasure.
Likewise, while OT and IT systems are often highly related, segment ICS resources from IT resources wherever possible.
Maintain regular offsite backups to protect against data encryption, corruption, and natural disasters.
Unlike many other ransomware and e-crime actors, Darkside deploys techniques that attack other operating systems besides Microsoft Windows, including launching their own virtual machines where possible. Ensure your anti-virus/intrusion protection systems have current detection packages and signatures, can detect non-Windows activity, and includes network monitoring.
Files stolen in ransomware attacks can often be sizable. Establish a detection rule for files leaving the network of an above average size, particularly in a compressed format such as .zip, .rar, .tar, .7z, or .gz
Many Russian-language threat actors perform a language check against the target system, and will abandon the attack if a Cyrillic language pack is installed. It does not need to be used in order to be effective, only installed.
It is not currently known what data was stolen from Colonial Pipeline during the attack. If you have any concern that you have affiliate data that may have been compromised in this breach then please enable multi-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks.

Details

While Colonial Pipeline has not made an official announcement about the attribution of the attack, on May 10, a statement made by the Federal Bureau of Investigation (FBI) confirmed that DarkSide ransomware is responsible for the compromise of the Colonial Pipeline. Numerous media outlets had previously cited an anonymous US official who reportedly told the Washington Post that the DarkSide ransomware gang was behind the attack. While the threat actors have not reportedly responded to any media inquiries or claimed any responsibility, they have released a brief note on their [.]onion leak page. According to the May 10 note, while the threat actors appear to distance themselves from any geopolitical implications, they do not make any claims about the incident or make any explicit reference to Colonial Pipeline. The group also noted that they would be introducing measures to moderate the activity of their Ransomware-as-a- Service “partners.” Figure 1 is a screenshot of the DarkSide operators' latest post on their data leak website tating that they are an apolitical group and that their goal is to make money.

Figure 1: Post made by DarkSide operators shortly after the Colonial Pipeline ransomware attack

According to Bloomberg, the attackers stole nearly 100 gigabytes of data within two hours from the company network, which is based in Alpharetta, Georgia. However, on May 8, the FBI and other government agencies reportedly took offline the cloud computing system the gang used to collect stolen data. To date, ZeroFOX has not observed any leaked data thought to be sourced from the attack. As of May 13, Bloomberg reported that Colonial Pipeline paid a USD $5M ransom to decrypt encrypted systems.

The DarkSide ransomware group, which began operations around August 2020, has performed targeted attacks against numerous companies, including two major electric utilities companies in Brazil - Centrais Eletricas Brasileiras (Eletrobras) and Companhia Paranaense de Energia (Copel), in February 2021. DarkSide uses a ransomware-as-a-service model. It is a selective operation with affiliates interviewed before being given access to DarkSide's control panel. DarkSide shares profit with the affiliates, who retain a percentage of the ransom fee from each victim, which usually starts at 25 percent for ransom fees less than $500,000 USD and decreases to 10 percent for ransom fees greater than $5M USD.

Similar to other ransomware types, DarkSide operators spread laterally across network devices until they gain access to an administrator account and the Windows domain controller. DarkSide operators have leveraged attack vectors such as phishing and remote desktop protocol vulnerabilities to distribute DarkSide ransomware to their targets. DarkSide is also known to have previously used double extortion tactics, whereby victim files are also stolen, with the threat of its exposure on the internet used as leverage for the victim to pay ransom demands. Figure 2 is a screenshot of a DarkSide ransom note. The image has been modified to remove references to the victim and DarkSide ransomware websites.

Figure 2: DarkSide ransom note instructions on decrypting encrypted files and paying ransom demands

On May 9, The US Department of Transportation (USDOT) announced that to avoid disruption to supply, the Federal Motor Carrier Safety Administration (FMCSA) issued a temporary hours of service exemption that applies to those transporting gasoline, diesel, jet fuel, and other refined petroleum products to Alabama, Arkansas, District of Columbia, Delaware, Florida, Georgia, Kentucky, Louisiana, Maryland, Mississippi, New Jersey, New York, North Carolina, Pennsylvania, South Carolina, Tennessee, Texas, and Virginia.

Oil refining companies reportedly said their operations had not yet been impacted. On May 9, Kinder Morgan Inc, stated its Products (SE) Pipeline Corporation (PPL), serving many of the same regions, remains in full service and working around the clock to accommodate additional barrels during Colonial's downtime.

As of May 10, gasoline futures are up about 0.7 percent at USD 2.14 a barrel, after they had advanced as much as 4.2 percent in overnight trading, but analysts reportedly said prices for gasoline, particularly spot prices in regions impacted by the closure, could continue to rise if the pipeline is not back in service in a few more days.

DarkSide Metrics Overview

ZeroFOX Research has tracked reported DarkSide ransomware infections since 2020. The group operates a data leak website exposing the names and data of their victims. Since February 2021, DarkSide operators have targeted numerous victims. ZeroFOX's research revealed that the majority of victims, around 76 percent, were located in North America. This figure was followed by victims located in the European Union (EU) and Russia with a smaller percentage, around 15 percent. (ZeroFOX Note: All organizations affected in this region are EU-based) Figure 3 displays a pie chart depicting the percentages of DarkSide victims around the world.

Figure 3: DarkSide ransomware targets by geographic region since February 2021

Displayed in Figure 4, the top three DarkSide industry targets since February 2021 were retail and consumer packaged goods (CPG) (22 percent), manufacturing (21 percent), and legal consulting (16 percent).

Figure 4: DarkSide ransomware targets by industry since February 2021

Other industries followed with smaller percentages, including healthcare organizations. In November 2020, a DarkSide operator claimed in an affiliate advertisement posted on a Russian-speaking forum that targeting organizations in medicine, education, public sector, and non-profit organizations were strictly prohibited. Figure 5 is a screenshot of the post followed by its English translation.

Figure 5 Snippet of DarkSide affiliate advertisement posted in a Russian-speaking forum

English translation of Russian text in Figure 5:

Rules?
The following areas are prohibited:
- Medicine (Hospitals, hospitals). 
- Education (Universities, schools). 
- Public sector (municipalities, any government bodies). 
- Non-profit organizations (charities, associations).

Sources

hXXps://www[.]colpipe[.]com/news/press-releases/media-statement-colonial-pipeline-system-disruption
hXXps://www[.]fbi[.]gov/news/pressrel/press-releases/fbi-statement-on-network-disruption-at-colonial-pipeline
hXXps://www[.]wsj[.]com/articles/fbi-suspects-criminal-group-with-ties-to-eastern-europe-in-pipeline-hack-11620664720?mod=hp_lead_pos1
hXXp://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id[.]onion/press-center
https://www[.]fmcsa[.]dot[.]gov/emergency/esc-ssc-wsc-regional-emergency-declaration-2021-002-05-09-2021
hXXps://www[.]transportation[.]gov/briefing-room/us-department-transportations-federal-motor-carrier-administration-issues-temporary
hXXps://www[.]washingtonpost[.]com/business/2021/05/08/cyber-attack-colonial-pipeline/
hXXps://www[.]wsj[.]com/articles/as-colonial-pipeline-shutdown-drags-on-after-hack-eyes-are-on-gasoline-prices-11620660258
hXXps://www[.]wsj[.]com/articles/u-s-pipeline-shutdown-exposes-cyber-threat-to-energy-sector-11620574464
hXXps://www[.]foxbusiness[.]com/markets/crude-oil-prices-in-focus-after-colonial-pipeline-cyberattack
hXXps://eletrobras[.]com/pt/ri/ComunidadoseFatos/Comunicado%20ao%20Mercado%20-%2003[.]02[.]21%20-%20Eletronuclear[.]pdf
hXXps://www[.]bleepingcomputer[.]com/news/security/largest-us-pipeline-shuts-down-operations-after-ransomware-attack/
hXXps://www[.]bloomberg[.]com/news/articles/2021-05-09/u-s-fuel-sellers-scramble-for-alternatives-to-hacked-pipeline
hXXps://www[.]cnbc[.]com/2021/05/08/colonial-pipeline-shuts-pipeline-operations-after-cyberattack[.]html
hXXps://www[.]nbcnews[.]com/politics/national-security/russian-criminal-group-may-be-responsible-colonial-pipeline-ransomware-attack-n1266793
hXXps://www[.]newsweek[.]com/cyber-attack-colonial-pipeline-emergency-declaration-1589936
hXXps://www[.]reuters[.]com/business/energy/ransom-group-linked-colonial-pipeline-hack-is-new-experienced-2021-05-09/
hXXps://apnews[.]com/article/europe-hacking-government-and-politics-technology-business-333e47df702f755f8922274389b7e920
hXXps://seekingalpha[.]com/news/3693613-colonial-pipeline-shut-after-cyberattack
hXXps://seekingalpha[.]com/news/3693634-biden-turns-to-emergency-powers-to-counter-colonial-pipeline-disruption
hXXps://thehill[.]com/policy/energy-environment/552569-gas-prices-set-to-rise-after-pipeline-cyberattack
hXXps://www[.]bbc[.]com/news/business-57050690
hXXps://us-cert[.]cisa[.]gov/ncas/alerts/aa21-131a
hXXps://www[.]bloomberg[.]com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom