Worked example · 2021-05

Colonial Pipeline ransomware extortion payment — 2021-05

Loss

Colonial Pipeline paid approximately 75 BTC (~$4.4M at time of payment) to the DarkSide ransomware-as-a-service group on 2021-05-08 [secsysnews], following the encryption of Colonial's corporate IT network. CISA reported no indication that the actor moved laterally into the operational-technology (OT) network; the pipeline company proactively disconnected certain OT systems [cisaaa21131a]. The DOJ announced on 2021-06-07 the seizure of 63.7 BTC (~$2.3M) of the payment under a warrant authorised in the Northern District of California; the FBI held the private key for the receiving address [secsysnews] [cyberscoop].

OAK Techniques observed

OAK-T5.008 (Ransomware Extortion Payment) — canonical PATH A + PATH C anchor. The payment was made to a DarkSide operator address on a known ransomware threat-intelligence feed, and the DarkSide affiliate-split structure (victim → affiliate → DarkSide operator; split percentages unverified) is consistent with the RaaS two-hop fingerprint. The seizure of 63.7 BTC traced from the ransom payment supports the attribution chain.

Attribution

confirmed — the FBI, per Deputy Director Abbate at the 2021-06-07 press conference, identified a wallet that "the DarkSide actors used to collect a payment from a victim" [cyberscoop]; DarkSide is described by CyberScoop as believed to be Russia-based [cyberscoop]. Reporting says the seizure affidavit did not explain how the FBI came to hold the private key [jurist].

OAK-G19

DarkSide is the canonical ransomware-as-a-service cluster whose operational impact — triggering the U.S. whole-of-government ransomware response architecture, the Colonial Pipeline FBI seizure precedent, and the presidential cybersecurity executive order (EO 14028) — makes it one of the most structurally significant ransomware actors in the OAK taxonomy despite its short operating window (CISA: targeting large organisations since August 2020 [cisaaa21131a]). See actors/OAK-G19-darkside.md.

Corrected 2026-10-11

Payment date is 2021-05-08 (not 05-07), warrant was N.D. Cal., and unsourced East Coast supply share, pipeline size, FBI New York Field Office and 75-85% affiliate split were removed.

Key teaching point

Colonial Pipeline is the canonical T5.008 anchor demonstrating detection PATH A (known-address hit against a ransomware-operator feed) + PATH C (RaaS affiliate-split two-hop structure). The FBI's ability to trace and seize the extortion payment — despite the victim's cryptographic authorisation — demonstrates that T5.008 is a post-payment detection and recovery domain, not a pre-payment prevention domain.