extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

Darkside

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under Darkside in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

CISA, FBI, and NSA describe DarkSide RaaS as active from September 2020 through May 2021. A possible BlackMatter rebrand is recorded separately with moderate confidence.

Source name
Darkside
Canonical lineage name
DarkSide
Entity model
operation
First observed
September 2020
Last observed
May 2021
Current status
Inactive

Documentary media

First page of the federal seizure-warrant affidavit for cryptocurrency traced to the Colonial Pipeline ransom payment
DarkSide ransom-proceeds seizure affidavitFirst page of the FBI affidavit supporting a seizure warrant for cryptocurrency traced to the Colonial Pipeline ransom payment. DOJ announced the seizure on 7 June 2021; the filing does not depict DarkSide personnel.U.S. Department of Justice · published 2021-06-07 · Primary evidenceEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedThe first page of an official filing is reproduced at reduced resolution to identify and discuss the cited seizure record. DOJ's policy warns that third-party material and official insignia may have separate restrictions; no broader rights claim is made.Source: U.S. Department of Justice and FBI affidavit, case 3:21-mj-70945-LB.
1 additional reviewed record
First page of the official joint BlackMatter ransomware advisory
Joint BlackMatter ransomware advisoryFirst-page preview of the CISA, FBI, and NSA advisory that describes BlackMatter and preserves the agencies' wording that it was a possible DarkSide rebrand.CISA, FBI, and NSA · published 2021-10-18 · Contextual materialEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedA low-resolution first-page excerpt is used to identify and discuss the underlying official advisory. Agency marks remain only within the unaltered document preview; no general reuse license is claimed.Source: CISA, FBI, and NSA joint advisory AA21-291A.

Known aliases

No source-supported alias is currently recorded. Malware names and actor-group names are not assumed to be equivalent.

Historical timeline

Lineage and relationships

Relationships shown from this actor's perspective
Related actor or familyRelationshipPeriodConfidenceEvidence summarySources
BlackMatteroperation Rebranded assuspected · directed From July 2021 Moderate confidence

CISA, FBI, and NSA describe BlackMatter as a possible DarkSide rebrand. The source does not confirm complete operator continuity.

  • The joint advisory says BlackMatter is a possible rebrand of DarkSide and dates the two operations on either side of May–July 2021.
 CISA, FBI, and NSA

Predecessors

None established.

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

None established.

MITRE ATT&CK integration

No explicit MITRE ATT&CK group mapping is published for this source label. Software entries and fuzzy name matches are not promoted to group mappings.

External intelligence references

  1. BlackMatter RansomwareCISA, FBI, and NSA · government advisory · primary authoritative
  2. Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists DarkSideU.S. Department of Justice · law enforcement · primary authoritative

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Darkside notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Darkside. Its 1 archived note is counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter Darkside records

Collection: 5 records · 425 messages

Darkside negotiation record collection
Participants Source Archive status
You must pay $ 10000000 220.02 BTC (+20%) or 23879.46 XMR 10 Darkside JSON Indexed
You must pay $ 250000 5.51 BTC (+20%) or 603.89 XMR 63 Darkside, Victim JSON Indexed
20210215 24 Darkside, Victim JSON Indexed
20201115 243 Darkside, Victim JSON Indexed
You need pay $ 2,000,000 190.363 BTC (+10%) or 22537.751 XMR 85 Darkside, Victim JSON Indexed