PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-09-25
Data as of September 24, 2026 at 17:02 UTC
Search
MITRE ATT&CK G0128

DarkSide

View MITRE Group Page ↗
Aliases: BlackMatter, ALPHV Affiliate
Official Attribution Source: CISA Advisory AA21-131A & DOJ Forfeiture Actions

Key Facts

Jurisdiction
Russian Federation
Geographic origin
Cases
1
Prosecution matters
Defendants
0
Indicted individuals
Sanctions
0
OFAC designations
  • Attributed Country: Russian Federation.
  • ATT&CK Group Reference: G0128 (DarkSide).
  • Linked to 1 primary court prosecution records.
  • Identified 0 individually charged operatives.

Primary ATT&CK Techniques Employed

ATT&CK Techniques Mapped to DarkSide Technique frequencies extracted from verified indictments for DarkSide. T1078 Valid Accounts 1 incidents T1486 Data Encrypted for Impact 1 incidents T1041 Exfiltration Over C2 Channel 1 incidents T1021.001 Remote Desktop Protocol 1 incidents
Technique frequencies extracted from verified indictments for DarkSide.
ATT&CK Techniques Mapped to DarkSide
Technique Frequency
T1078 Valid Accounts 1 incidents
T1486 Data Encrypted for Impact 1 incidents
T1041 Exfiltration Over C2 Channel 1 incidents
T1021.001 Remote Desktop Protocol 1 incidents

Prosecution Cases Attributed to This Actor

pleaded 2021-05-07

Colonial Pipeline DarkSide Ransomware Attack

DarkSide ransomware extortion against the largest refined petroleum pipeline system in the United States, forcing the shutdown of 5,500 miles of fuel pipelines and triggering widespread East Coast fuel shortages.

4 techniques View case →