China News Service, May 15th. According to US media reports, the "dark side" of the hacker team that attacked the Colonial Pipeline system in the United States and paralyzed the "oil pipeline" of the United States, announced that the team plans to disband.
The US "Wall Street Journal" reported that, according to security companies FireEye and Inter471, the "dark side" stated that due to pressure from the US government and "sabotage" by law enforcement agencies, the organization lost access to its operating structure. Will be closed.
The Washington Post reported that the organization stated in an email sent to its partners that the organization had been closed.
Since noon on the 13th, the "Dark Side" blog on the dark web has been closed.
However, security experts pointed out that the news of the disbandment of the hacker team may be just a "blind approach."
It is not uncommon for a similar team to announce its dissolution and then reappear under a new name.
The organization may simply try to “run if you take the money” and disappear from the public eye to escape the pressure of this high-profile attack.
Michael Daniel, who served as a network coordinator in the Obama administration, said that the organization is likely to dissolve on its own and will be reorganized under another name.
He said that it is not undesirable that its dissolution is the result of government actions, but "it is unlikely based on the current situation, mainly because it (happens) too early."
On the 7th, cyber hackers used encryption to lock the computer system of the Colonial Pipeline Transportation Company and stole confidential documents to unlock them for ransom.
The US Federal Bureau of Investigation (FBI) confirmed in a statement on the 10th that the hacker organization "Dark Side" was responsible for this incident.
The "dark side" also spoke on the same day, stating that "our goal is to make money, not to create problems for society." On the 12th, Colonial Pipeline Transportation Company announced that the oil pipeline system had begun to resume operations.
Bloomberg previously quoted sources as reporting that the Colonial Pipeline Company paid hackers a huge ransom of nearly 5 million U.S. dollars in cryptocurrency.
After receiving the ransom, the hacker provided the company with a decryption tool to restore its paralyzed computer network.
However, a person familiar with the company's work said that the tool was so slow that the company continued to use its own backups to help restore the system.
In addition, the "dark side" is reported to have attacked Toshiba Group's French base, stealing more than 740GB of confidential information. Toshiba TEC admitted that its European subsidiaries had been attacked by cyber attacks, stating that “data leakage is likely to occur”.