Colonial Pipeline Hack Claimed By Russian Group Darkside Spurs Emergency Order From White House

The federal government issued a rare emergency declaration on
Sunday after a cyberattack on a major U.S. pipeline choked the
transportation of oil to the eastern U.S.

The Colonial Pipeline, responsible for the country’s largest
fuel pipeline, shut down all its operations Friday after hackers
broke into some of its networks. All four of its main lines remain
offline.

The emergency declaration from the Department of Transportation
aims to ramp up alternative transportation routes for oil and gas.
It lifts regulations on drivers carrying fuel in 17 states across
the South and eastern United States, as well as the District of
Columbia, allowing them to drive between fuel distributors and
local gas stations on more overtime hours and less sleep than
federal restrictions normally allow. The U.S. is already dealing
with a shortage of tanker truck drivers.

The emergency order extends through June 8, and can be renewed.
Colonial has yet to declare a date it expects it will resume full
operations.

In a statement Monday afternoon, the company indicated it was
working to slowly resume operations and hopes to restore services
by the end of the week.

“While this situation remains fluid and continues to evolve, the
Colonial operations team is executing a plan that involves an
incremental process that will facilitate a return to service in a
phased approach,” the company said in a press release.

In a press briefing Monday, Homeland Security Advisor Elizabeth
Sherwood-Randall said that Colonial initially shut down its
networks as a precautionary measure, and that while the hackers
broke into networks devoted to the company’s business operations,
it did not reach computers that control the physical infrastructure
that transports gasoline and other fuel.

Industry experts have already warned that a prolonged shutdown
of the pipeline could push gas prices higher and cause disruptions
in eastern parts of the U.S.

The FBI confirmed Monday that the culprit is a strain of
ransomware called DarkSide, believed to be operated by a Russian
cybercrime gang referred to by the same name.

The FBI said that “the DarkSide ransomware is responsible for
the compromise of the Colonial Pipeline networks. We continue to
work with the company and our government partners on the
investigation.” The official attribution from the FBI came more
quickly than in some past cyberattacks.

Like many ransomware gangs, DarkSide makes money by hacking a
victim’s network, encrypting their files so they can’t be accessed
and threatening to publish them online if they’re not paid a hefty
fee.

In a statement posted to its website, DarkSide echoed a
sentiment common across ransomware gangs — that they’re an
apolitical group, only interested in making money — but seemed to
acknowledge that by hampering the fuel industry, they may have
crossed a line with the United States that no ransomware gang has
crossed before.

“We are apolitical, we do not participate in geopolitics, do not
need to tie us with a defined goverment and look for other our
motives,” the gang posted, misspelling “government.”

“Our goal is to make money, and not creating problems for
society. From today we introduce moderation and check each company
that our partners want to encrypt to avoid social consequences in
the future.”

The attack is the latest in a recent rush of unrelated
ransomware attacks across the country. A different group recently
broke into Washington, D.C.’s Metropolitan Police Department and
began leaking extremely detailed and personal files on officers. A
third stole files from a major Apple supplier based in Taiwan and
released previously private specs for Apple products.

Many Russian cybergangs work as independent operations, though
they are sometimes recruited to work for Russian intelligence — and
they generally avoid attacking targets in Russia.

Brett Callow, an analyst at the cybersecurity company Emsisoft
who tracks ransomware, said there were signs in DarkSide’s
malicious software that it was meant to hit targets outside Russia
and eastern Europe. He noted that the software is coded to not work
against computers where Russian or one of several other eastern
European languages are set as the default.

“DarkSide doesn’t eat in Russia,” Callow said. “It checks the
language used by the system and, if it’s Russian, it quits without
encrypting.”

In any scenario, it will take some time for Colonial to recover
from the event, Callow said. It can take days for any large company
to restore its system from data backups. Even if Colonial were to
acquire a file decryptor program from the gang itself — either
through paying the ransom or if DarkSide were to voluntarily
provide one — it would be a slow process because of the way it’s
encoded, he said.

“Remediation and recovery is not necessarily a quick and easy
process, and while essential functionality can be restored more
quickly, it can take organizations weeks or even months to fully
return to normal operations,” he said.

The federal government issued a rare emergency declaration on
Sunday after a cyberattack on a major U.S. pipeline choked the
transportation of oil to the eastern U.S.

The Colonial Pipeline, responsible for the country’s largest
fuel pipeline, shut down all its operations Friday after hackers
broke into some of its networks. All four of its main lines remain
offline.

The emergency declaration from the Department of Transportation
aims to ramp up alternative transportation routes for oil and gas.
It lifts regulations on drivers carrying fuel in 17 states across
the South and eastern United States, as well as the District of
Columbia, allowing them to drive between fuel distributors and
local gas stations on more overtime hours and less sleep than
federal restrictions normally allow. The U.S. is already dealing
with a shortage of tanker truck drivers.

The emergency order extends through June 8, and can be renewed.
Colonial has yet to declare a date it expects it will resume full
operations.

In a statement Monday afternoon, the company indicated it was
working to slowly resume operations and hopes to restore services
by the end of the week.

“While this situation remains fluid and continues to evolve, the
Colonial operations team is executing a plan that involves an
incremental process that will facilitate a return to service in a
phased approach,” the company said in a press release.

In a press briefing Monday, Homeland Security Advisor Elizabeth
Sherwood-Randall said that Colonial initially shut down its
networks as a precautionary measure, and that while the hackers
broke into networks devoted to the company’s business operations,
it did not reach computers that control the physical infrastructure
that transports gasoline and other fuel.

Industry experts have already warned that a prolonged shutdown
of the pipeline could push gas prices higher and cause disruptions
in eastern parts of the U.S.

The FBI confirmed Monday that the culprit is a strain of
ransomware called DarkSide, believed to be operated by a Russian
cybercrime gang referred to by the same name.

The FBI said that “the DarkSide ransomware is responsible for
the compromise of the Colonial Pipeline networks. We continue to
work with the company and our government partners on the
investigation.” The official attribution from the FBI came more
quickly than in some past cyberattacks.

Like many ransomware gangs, DarkSide makes money by hacking a
victim’s network, encrypting their files so they can’t be accessed
and threatening to publish them online if they’re not paid a hefty
fee.

In a statement posted to its website, DarkSide echoed a
sentiment common across ransomware gangs — that they’re an
apolitical group, only interested in making money — but seemed to
acknowledge that by hampering the fuel industry, they may have
crossed a line with the United States that no ransomware gang has
crossed before.

“We are apolitical, we do not participate in geopolitics, do not
need to tie us with a defined goverment and look for other our
motives,” the gang posted, misspelling “government.”

“Our goal is to make money, and not creating problems for
society. From today we introduce moderation and check each company
that our partners want to encrypt to avoid social consequences in
the future.”

The attack is the latest in a recent rush of unrelated
ransomware attacks across the country. A different group recently
broke into Washington, D.C.’s Metropolitan Police Department and
began leaking extremely detailed and personal files on officers. A
third stole files from a major Apple supplier based in Taiwan and
released previously private specs for Apple products.

Many Russian cybergangs work as independent operations, though
they are sometimes recruited to work for Russian intelligence — and
they generally avoid attacking targets in Russia.

Brett Callow, an analyst at the cybersecurity company Emsisoft
who tracks ransomware, said there were signs in DarkSide’s
malicious software that it was meant to hit targets outside Russia
and eastern Europe. He noted that the software is coded to not work
against computers where Russian or one of several other eastern
European languages are set as the default.

“DarkSide doesn’t eat in Russia,” Callow said. “It checks the
language used by the system and, if it’s Russian, it quits without
encrypting.”

In any scenario, it will take some time for Colonial to recover
from the event, Callow said. It can take days for any large company
to restore its system from data backups. Even if Colonial were to
acquire a file decryptor program from the gang itself — either
through paying the ransom or if DarkSide were to voluntarily
provide one — it would be a slow process because of the way it’s
encoded, he said.

“Remediation and recovery is not necessarily a quick and easy
process, and while essential functionality can be restored more
quickly, it can take organizations weeks or even months to fully
return to normal operations,” he said.