By Justin Katz
May 11, 2021
The FBI on Monday attributed the cyberattack against Colonial Pipeline to ransomware group Darkside. The attack, which was announced on Friday, led to the shutdown of fuel pipelines serving the East Coast of the United States as a precautionary measure.
At a White House briefing on Monday, officials provided details on the government response. Deputy National Security Advisor Anne Neuberger described Darkside as "ransomware as a service" operation in which the malware developers share proceeds from attacks with partners. Neuberger didn't say whether the government believes the breach may have progressed from Colonial's IT to operational technology that controls the pipelines, citing the ongoing criminal investigation but said that such spread was a "concern," and said that's why, "quickly and effectively negating the spread of the ransomware is always the first area of priority."