Colonial Pipeline Ransomware: Hunting DarkSide's Fuel Heist

How DarkSide Hacked America's Fuel Pipeline – Full Investigation, Threat Hunting Queries, and Falcon Lessons (2026 Edition)

On May 7, 2021, the United States faced its largest fuel shortage since the 1970s. Colonial Pipeline, operator of 5,500 miles of critical infrastructure supplying 45% of East Coast gasoline, shut down operations amid a ransomware attack. Panic buying ensued, gas prices spiked 60% in spots, and the FBI confirmed DarkSide—a Russia-linked RaaS (Ransomware-as-a-Service) group—as culprits. Colonial paid $4.4 million in Bitcoin, later partially recovered.

This wasn't a zero-day exploit; it was classic RDP initial access evolving into devastating encryption. Fast-forward to 2026: Similar TTPs fuel 70% of ransomware incidents. In this first installment of our "Ransomware Takedown Chronicles" series, we dissect the full attack lifecycle, FBI investigation, IOCs, and 12 battle-tested CrowdStrike Falcon queries to hunt DarkSide-like threats in your environment. If you read our RDP hunting series, note how anomalous public IP RDP (port 3389) was the entry point here.

Whether you're a SOC analyst, threat hunter, or CISO, these insights and queries will arm you against pipeline-style disruptions.

Attack Timeline: From RDP Brute-Force to Pipeline Shutdown

DarkSide operated April 2020–May 2021, extorting $90M+. Colonial breach unfolded over weeks:

Sources: Colonial SEC filing, FireEye Mandiant report. DarkSide used Cobalt Strike for C2, exfiltrating HR/payroll data before wiping backups.

The Investigation: FBI, FireEye, and EDR Magic

Colonial detected encryption May 6 via alerts on anomalous file I/O. IR engaged FireEye (now Mandiant), revealing:

RDP logs showed logon type 10 from non-corp IPs.

Sysmon captured psexec.exe spawning encryptor.

Falcon-like EDR traced C2 to russianmarket[.]to infrastructure.

FBI seized $2.3M via blockchain trace (wallet 1B58vByk... ). Takedown ops disrupted DarkSide builders in Eastern Europe.

Key Lessons:

Dwell time: 1 month undetected.

No MFA on RDP/VPN.

Flat network enabled full compromise.

Threat Hunting: Detect DarkSide TTPs with CrowdStrike Falcon

Falcon LogScale/Insight shines here—query Windows ETW, Sysmon, network flows. Replace your_internal_cidrs with your nets (e.g., "10.0.0.0/8").

1. RDP Initial Access from Public IPs (Entry Vector)

event_simpleName=UserLogon 

LogonType_decimal=10 

RemoteIP!~*your_internal_cidrs 

| stats count as rdp_attempts, dc(UserName) by RemoteIP, ComputerName 

| where rdp_attempts > 3 

| sort - rdp_attempts

Expected Hits: Colonial saw 50+ from single VPS. Alert on >5.

2. Failed RDP Preceding Success (Brute-Force)

index=security 

EventId_decimal=4625 LogonType_decimal=10 

| stats fails=count() by Account_Name, WorkstationName 

| join Account_Name [search event_simpleName=UserLogon LogonType_decimal=10 | stats succeeds=count() by Account_Name] 

| where fails > 10 and succeeds > 0

3. PsExec Lateral Movement (SMB Abuse)

event_simpleName=NetworkConnectIP4 

ProtocolName="SMB" RemotePort_decimal=445 

| join ContextProcessId_decimal=[search event_simpleName=ProcessRollup2 ImageFileName=~"psexec.exe|at.exe"] 

| table ComputerName, RemoteIP, ImageFileName, CommandLine 

| sort by _time desc

4. Cobalt Strike Beacon Hunting (Living Off Land)

event_simpleName=ProcessRollup2 

CommandLine=~"(certutil -urlcache -split -f http|bitsadmin /transfer|powershell -nop -w hidden -c IEX)" 

| stats count by aid, CommandLine, ParentImageFileName 

| where ParentImageFileName !~*explorer

5. Mimikatz Credential Dumping

event_simpleName=*Security* 

| search CommandLine=~"(sekurlsa::|lsadump::|minidump)" or ProcessImageFileName=~mimikatz 

| join ParentContextProcessId_decimal=[search event_simpleName=UserLogon LogonType_decimal=10]

6. Scheduled Task Persistence (BITS/RDP)

event_simpleName=ProcessRollup2 

ImageFileName=~"bitsadmin|sc.exe|netsh" 

CommandLine=~"(add|create|advfirewall)" 

| table aid, CommandLine, aid_ParentProcessId_decimal

7. High-Volume Exfiltration (Pre-Encryption)

event_simpleName=NetworkConnectIP4 

Bytes_decimal > 50000000 

RemotePort_decimal in (80,443,8080) 

| stats total_exfil=sum(Bytes_decimal) by RemoteIP, ComputerName 

| where total_exfil > 1GB

8. Encryption Indicators (File I/O Anomalies)

event_simpleName=FileCreate 

FileName=~"\.(encrypted|darkside|readme\.txt)$" or count_from_Previous > 1000 

| group by aid, FilePath

9. C2 Beaconing (DarkSide IOCs)

event_simpleName=NetworkConnectIP4 

RemoteIP in ("o(.)dajbyf(.)ru", "xmrig(.)to", "1B58vBykFqtNj3D8H2R4sYxYp2jYhZq8h") 

| stats count by RemoteIP, UserAgent

Note: Please replace (.) with just dot. This is added here for avoiding any detection on our page.

10. Post-Exploitation PowerShell (LotL)

event_simpleName=ProcessRollup2 

ImageFileName="powershell.exe" 

CommandLine=~"-enc|-w 1|-nop" 

| join ContextThreadId_decimal=[search event_simpleName=UserLogon]

11. Backup Wipe Attempts (VSSAdmin)

event_simpleName=ProcessRollup2 

CommandLine=~"vssadmin.*delete|wbadmin.*delete|bcde Dit"

12. Aggregate Ransomware Scorecard

index=* | search (LogonType_decimal=10 and RemoteIP!~*internal) or ImageFileName=~"psexec|mimikatz|certutil" 

| stats score=sum(case(ImageFileName=~"psexec|mimikatz", 10, LogonType_decimal=10, 20, 1)) by ComputerName 

| where score > 30 | sort - score

For maximum results:

Run over 90 days; use head 1000.

Visualize: Heatmap RDP by hour/geolocation.

This MITRE ATT&CK heatmap shows DarkSide's heavy TA0008 reliance—query it in Falcon.

Mitigation: Prevent Your Colonial Moment

RDP Lockdown: VPN + MFA (Azure AD); restrict to jump hosts.

Network Segmentation: Microseg OT/IT (NSX, Illumio).

Backup 3-2-1: Air-gapped, immutable (Veeam).

EDR Hardening: Falcon ransomware shield + behavioral prevents.

IRP Playbooks: Tabletop quarterly.

Falcon Configs:

Custom IOCs for DarkSide hashes.

ML model tuning for SMB anomalies.

Key Takeaways & FBI Insights

Colonial's pain underscores: Hunt proactively, segment ruthlessly. FBI: "Ransomware is cybercrime's oil boom." Your SOC can outhunt them.

Next in Series: Change Healthcare BlackCat – Phishing to $22M Payout. Subscribe!

Post by

newWorld

Keywords: Colonial Pipeline ransomware case study, DarkSide threat hunting, CrowdStrike Falcon ransomware queries, RDP initial access Falcon, ransomware investigation 2026.