DarkSide Disappeared, but its Affiliates Continues to Operate

DarkSide, the group responsible for the notorious ransomware attack used in the attack on Colonial Pipeline, generated national panic and skyrocketing gas prices. While they announced a retirement, their platforms are still operational. By May 23, the DarkSide cybercriminal group agreed to provide decryptors for all ransomware targets and pay for outstanding financial obligations. While the news of the group's surrender is heartening, the threat posed by the bad actors that use its ransomware has not been eliminated.  According to RiskIQ, researchers discovered that some of the infrastructure associated with UNC2465, which the group used to deploy malware other than the DarkSide ransomware, is still operational and could pose a threat.