RansomWare Attack in Third Day, Oil/Gas Supplies Threatened

May 10, 2021

An example of a DarkSide ransomware notice that appears on victims’ computer screens

Extortion network may have ties to Russia.

BBC:

The US government issued emergency legislation on Sunday after the largest fuel pipeline in the US was hit by a ransomware cyber-attack.

The Colonial Pipeline carries 2.5 million barrels a day – 45% of the East Coast’s supply of diesel, petrol and jet fuel.

The operator took itself offline on Friday after the cyber-attack and work to restore service is continuing.

The US government has relaxed rules on fuel being transported by road

It means drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.

US fuel prices at the pump were largely unaffected on Monday, but there are fears that could change if the shutdown is prolonged.

Independent oil market analyst Gaurav Sharma told the BBC a lot of fuel was now stranded at refineries in Texas.

“Unless they sort it out by Tuesday, they’re in big trouble,” said Mr Sharma. “The first areas to be hit would be Atlanta and Tennessee, then the domino effect goes up to New York.”

He said oil futures traders were now “scrambling” to meet demand, at a time when US inventories are declining, and demand – especially for fuel for cars – is on the rise as consumers return to the roads and the economy recovers.

The temporary waiver issued by the Department of Transportation enables oil products to be shipped in tankers up to New York, but this would not be anywhere near enough to match the pipeline’s capacity, Mr Sharma warned.

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial’s network and locked the data on some computers and servers, demanding a ransom on Friday.

The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. The cloud computing system the hackers used to collect the stolen data was taken offline on Saturday, Reuters reported.

Colonial’s data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers’ leverage to extort or further embarrass the company, the news agency said.

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational.

“Quickly after learning of the attack, Colonial proactively took certain systems offline to contain the threat. These actions temporarily halted all pipeline operations and affected some of our IT systems, which we are actively in the process of restoring,” the firm said.

It added it would bring its full system back online “only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations”.

CBS:

The cyberextortion attempt that’s forced the shutdown of a vital U.S. pipeline was carried out by a criminal gang known as DarkSide that cultivates a Robin Hood image of stealing from corporations and giving a cut to charity, two people close to the investigation said Sunday.

The shutdown, meanwhile, stretched into its third day, with the Biden administration loosening regulations of the transport of petroleum products on highways as part of an “all-hands-on-deck” effort to avoid disruptions in the fuel supply.

Experts said gasoline prices are unlikely to be affected if the pipeline is back to normal in the next few days but that the incident – the worst cyberattack to date on critical U.S. infrastructure – should serve as a wake-up call to companies about the vulnerabilities they face.

The pipeline, operated by Georgia-based Colonial Pipeline, carries gasoline and other fuel from Texas to the Northeast. It delivers roughly 45% of fuel consumed on the East Coast, according to the company.

It was hit by what Colonial called a ransomware attack, in which hackers  typically lock up computer systems by encrypting data and paralyzing networks, then demand a large ransom to unscramble it.

On Sunday, Colonial Pipeline said it was actively in the process of restoring some of its IT systems. It says it remains in contact with law enforcement and other federal agencies, including the Department of Energy, which is leading the federal government response. The company hasn’t said what was demanded or who made the demand.

However, two people close to the investigation, speaking on condition of anonymity, identified the culprit as DarkSide. It is among ransomware gangs that have “professionalized” a criminal industry that has cost Western nations tens of billions of dollars in losses in the past three years.

DarkSide claims it doesn’t attack hospitals and nursing homes, educational or government targets and that it donates a portion of its take to charity. It’s been active since August and, typical of the most potent ransomware gangs, is known to avoid targeting organizations in former Soviet bloc nations. 

Colonial didn’t say whether it has paid or was negotiating a ransom, and DarkSide neither announced the attack on its dark web site nor responded to an Associated Press reporter’s queries. The lack of acknowledgment usually indicates a victim is either negotiating or has paid.

3 Responses to “RansomWare Attack in Third Day, Oil/Gas Supplies Threatened”

  1. dumboldguy Says:

    Breaks my heart to hear of Colonial’s difficulties. All their pipelines pass within 1/2 mile of my house in NO VA and their tank farm/pumping station would be visible from my property if other houses and trees weren’t in the way.

    Down through the years there have been many small leaks in the immediate area, and much of the nearby groundwater is contaminated by plumes of fossil fuel contaminants. When I went over there to talk to them about that a few years ago, they got the FBI on my case as a potential eco-terrorist. Ever had an FBI agent knock on your door and say they had a few questions for you?

    Needless to say, I was kidding in my first sentence. Colonial could disappear from the face of the earth and I wouldn’t mind. Unfortunately, the folks in the east need them as long as they continue to burn fossil fuels. A conundrum indeed.

  2. rhymeswithgoalie Says:

    The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond.Makes it sound like publishing it is a bigger threat than just locking them out of control.


Leave a Reply to rhymeswithgoalie Cancel reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: