The Colonial Pipeline Ransomware Attack: A Technical Breakdown

What really happened when hackers took down America’s largest fuel pipeline—and what we should have learned from it.

Picture this: It’s early May 2021. You’re scrolling through the news with your morning coffee when you see reports of fuel shortages spreading across the East Coast. Gas stations are running dry. People are panic-buying gasoline like it’s toilet paper in March 2020. Lines wrap around the block. States of emergency are declared in multiple states.

The cause? Not a hurricane. Not a refinery fire. Not a geopolitical oil crisis.

A single compromised password on an unused VPN account.

Let me walk you through what actually happened with the Colonial Pipeline ransomware attack—how one of the most sophisticated ransomware groups exploited basic security failures to briefly hold America’s energy infrastructure hostage, and what we should have fixed afterward.

Part 1: How the Attack Happened—Initial Access

The Colonial Pipeline attack is almost painful in its simplicity. Here’s what went down:

April 29, 2021. DarkSide actors gained initial access to Colonial Pipeline’s enterprise network through something as mundane as a VPN connection. But here’s where it gets interesting—and by interesting, I mean frustrating.

The VPN account they used wasn’t even active. It was a legacy account—meaning someone had access, left the company or changed roles, and nobody bothered to deprovision it. The password worked, though. And it wasn’t some weak “password123” situation either; Colonial Pipeline’s CEO later testified that the password was complex.

So how did DarkSide get it?

Credential reuse from a separate breach.

That’s right. The password had appeared in a data breach somewhere else—likely years earlier—and the employee had reused it across multiple accounts. DarkSide (or their affiliate) found it on the dark web, gave it a try, and boom: they were in.

Now, here’s the real kicker: there was no multi-factor authentication (MFA) on that VPN. No second factor. No “enter the code from your authenticator app.” No “approve this login on your phone.” Nothing but a username and password standing between the attackers and Colonial’s enterprise network.

Once inside, the attackers established persistence using what’s called the “Valid Accounts” technique (MITRE ATT&CK T0859). They set up a connection proxy and began quietly doing what ransomware operators do best: moving laterally, surveying the environment, and exfiltrating data.

For nine days, they lived in Colonial’s network. Nine days. They had time to map the infrastructure, identify high-value targets, and stage their attack with precision.

Part 2: DarkSide Ransomware Group Tactics

Let’s talk about DarkSide for a minute, because understanding who hit Colonial Pipeline helps explain how it happened.

The RaaS Model

DarkSide operates as Ransomware-as-a-Service (RaaS). Think of it like a business franchise. DarkSide develops the malware, handles the payment infrastructure, maintains the encryption/decryption tools, and provides a “help desk” for victims. Their “affiliates” are the ones who actually break into targets and deploy the ransomware. When a victim pays, DarkSide takes their cut—usually 10-25%—and the affiliate gets the rest.

This division of labor means the people with elite hacking skills can focus on what they’re good at (intrusion), while DarkSide handles the operational overhead. It’s efficient, scalable, and disturbingly professional.

Double Extortion

DarkSide pioneered what’s now standard practice: double extortion. They don’t just encrypt your data—they steal it first.

Here’s the playbook:
1. Gain access
2. Identify sensitive files (financial records, customer data, proprietary information)
3. Exfiltrate that data to their servers
4. Deploy ransomware to encrypt everything
5. Present the victim with two choices: Pay up, or we release your data publicly

The encryption itself is brutal. DarkSide uses Salsa20 stream cipher combined with RSA-1024 asymmetric encryption. Breaking it without the private key? Functionally impossible. And DarkSide’s developers have been known to create custom builds for each affiliate, making signature-based detection difficult.

Command and Control

DarkSide’s C2 infrastructure is sophisticated. They route traffic through Tor (The Onion Router) using multi-hop proxies, making attribution nearly impossible. They’ve also been observed using Cobalt Strike—a legitimate penetration testing tool that’s become a favorite among threat actors for post-exploitation activities.

Their C2 typically runs over port 443 (HTTPS) through an RDP client, blending in with normal encrypted web traffic. Unless you’re specifically looking for anomalous patterns, their traffic looks like any other corporate user accessing the internet.

Target Selection

DarkSide publicly stated they prefer targeting “large, high-revenue organizations” that can afford to pay big ransoms. They explicitly claimed to avoid hospitals, schools, non-profits, and governments—ostensibly to avoid law enforcement attention. Energy infrastructure, with its incredible reliance on operational continuity, fits their ideal victim profile perfectly.

The Aftermath

Here’s a detail that sounds like a bad spy novel: shortly after the Colonial attack made global headlines, DarkSide announced they were shutting down. Their servers went offline. Their infrastructure disappeared.

Was it real? Was it rebranding? Most security researchers believe DarkSide simply reconstituted under a new name. In ransomware circles, that’s the playbook: attract too much heat, go quiet, return with a fresh identity.

Part 3: Impact on Critical Infrastructure

Let’s be clear about something: The ransomware never touched Colonial’s operational technology (OT) networks. The malware stayed entirely within the IT environment. No SCADA systems were compromised. No pipeline controllers were encrypted. No physical infrastructure was damaged.

And yet, Colonial Pipeline shut down their entire 5,500-mile pipeline system for six days.

Why?

Because when your billing systems are encrypted, your payment processing is offline, and you can’t confirm transactions—you can’t really operate. Colonial made the decision that without those business systems, they couldn’t safely manage fuel deliveries, track custody transfers, or handle the financial reconciliation that modern pipeline operations require.

It was a precaution. A risk management decision. And it cascaded into a national crisis.

The Supply Chain Collapse

Colonial Pipeline isn’t just some regional operator. It’s the largest refined products pipeline in the United States, stretching from Houston, Texas, to Linden, New Jersey. It carries roughly 45% of the East Coast’s fuel supply—gasoline, diesel, jet fuel, heating oil. We’re talking about 2.5 million barrels per day moving through a 20-inch steel artery that feeds airports, military bases, and gas stations from Florida to New Jersey.

When Colonial shut down, the East Coast felt it immediately.

• 17 states experienced fuel shortages
• 71% of gas stations in Charlotte, NC were out of fuel by May 11
• 87% of stations in Washington, D.C. ran dry by May 14
• Gasoline prices spiked an average of 4 cents per gallon, hitting a six-year high
• Airlines rerouted flights; some airports prioritized jet fuel for essential routes

And then there was the panic buying. Photos of people filling plastic bags with gasoline. Lines stretching for blocks. Arguments at the pump. The psychological impact was as significant as the physical shortage.

The Economic Ripples

Beyond the immediate fuel crisis, the attack demonstrated something terrifying: the interconnected vulnerability of our critical infrastructure. Colonial Pipeline isn’t just one company—it’s a node in a massive network of energy distribution. Take out that node, and the ripple effects touch transportation, logistics, manufacturing, emergency services, and military operations.

This wasn’t maximalist.

Part 4: Incident Response and Recovery

Let’s talk about what happened after Colonial discovered the attack—because their response, while controversial in some ways, was actually instructive.

Discovery and Containment

May 7, 2021, approximately 5:00 AM. A ransom note appeared on Colonial’s systems. The company’s IT security team recognized it immediately: DarkSide ransomware.

Within hours, Colonial CEO Joseph Blount made a decision that would later face scrutiny: he shut down the entire pipeline. This wasn’t because the OT systems were infected—they weren’t—but because the billing and operational management systems that support pipeline logistics were compromised. Without those systems, safe operation was uncertain.

It was a precautionary shutdown. A defensive move. And it was the right call.

The Ransom Payment

Here’s where opinions diverge. Within roughly 48 hours of discovering the ransom note, Colonial paid the attackers 75 Bitcoin—approximately $4.4 million at the time.

Why? Blount later testified before Congress that Colonial’s backups were unreliable. The decryption tool provided by DarkSide was needed to recover systems quickly. And time was critical—every hour the pipeline stayed down, the economic damage compounded.

Was it the right decision? That’s debatable. Cybersecurity orthodoxy says never pay ransoms—it incentivizes attackers and funds future crimes. But Blount faced an impossible choice: Pay and recover quickly, or refuse on principle while the East Coast burned through its strategic petroleum reserves.

In the end, Colonial got their decryption tool and began the long process of restoration.

Federal Response

The government response was swift and multi-agency:

• FBI confirmed DarkSide’s involvement within days and began tracking the Bitcoin transaction
• CISA issued a joint advisory (AA21-131A) on DarkSide TTPs and mitigation recommendations
• Department of Transportation issued emergency exemptions for truck drivers to transport fuel by road, bypassing hours-of-service restrictions
• President Biden declared a state of emergency, lifting limits on domestic fuel transport

Behind the scenes, something more interesting was happening. The FBI was tracking the Bitcoin wallet used for the ransom.

The Bitcoin Recovery

June 7, 2021. The Department of Justice announced they had seized 63.7 of the 75 Bitcoin paid to DarkSide—approximately $2.3 million at the time.

How? By following the blockchain. Bitcoin’s public ledger is, well, public. Law enforcement traced the funds through multiple transfers and ultimately discovered that they’d landed in a wallet for which the FBI had obtained the private key. With that key, they could legally seize the assets.

This was a watershed moment. It demonstrated that cryptocurrency isn’t as untraceable as criminals believe. It also sent a message: Paying ransoms might not be a one-way transaction.

Full Recovery

Colonial restarted their pipeline on May 13, 2021. Full operational capacity resumed within days. But the incident left permanent marks: heightened scrutiny on critical infrastructure security, new federal requirements for pipeline cybersecurity, and a national conversation about the fragility of our energy systems.

Part 5: Lessons for OT/ICS Security

If there’s one thing the Colonial Pipeline attack proved, it’s this: IT security failures can become OT disasters.

Let’s walk through the hard lessons.

1. Multifactor Authentication Is Non-Negotiable

The single most preventable failure in the Colonial attack was the lack of MFA on the VPN.

MFA would have stopped this attack cold. DarkSide had the password. They did not have the second factor—the authenticator code, the push notification, the hardware token. Attackers go after the path of least resistance. Adding a second factor on internet-facing services dramatically raises that barrier.

Every externally accessible account—VPN, RDP, web applications, cloud services—should require MFA. Period. No exceptions.

2. Credential Hygiene and Deprovisioning

The account DarkSide used shouldn’t have existed. It was a legacy account—meaning someone had left or changed roles, and the account was never deactivated.

This is a failure of identity and access management (IAM). Organizations need:

• Automatic deprovisioning when employees leave
• Regular access reviews to identify orphan accounts
• Password policies that prevent reuse—though password managers and MFA make this less critical

As for the credential reuse problem: The compromised password had appeared in a different breach years earlier. Organizations should subscribe to breach notification services and check employee credentials against known leaked databases. When a leak is detected, force password resets immediately.

3. Network Segmentation: Separate IT from OT

Here’s a critical design flaw that nearly every ICS environment struggles with: Colonial’s IT and OT networks weren’t properly segmented.

The ransomware stayed in IT. But Colonial couldn’t be certain it wouldn’t spread to OT. They shut down operations as a precaution that the attack could propagate.

This is the nightmare scenario for every OT security team: an IT breach that cascades into operational systems. The solution is proper network segmentation using frameworks like ISA/IEC 62443:

• Zones: logical groupings of assets with similar security requirements
• Conduits: controlled pathways for communication between zones
• DMZs: buffer zones between IT and OT networks

If Colonial had proper segmentation, they could have isolated the IT breach without fearing OT contamination.

4. Asset Visibility and Continuous Monitoring

You can’t protect what you can’t see. Colonial likely didn’t have comprehensive visibility into every device on their network—and I don’t just mean servers and workstations. I mean:

• SCADA systems and PLCs
• HMIs (human machine interfaces)
• Remote terminal units (RTUs)
• Engineering workstations
• Third-party vendor connections

Continuous monitoring for anomalous behavior is essential. DarkSide had nine days in the network before deployment. Nine days of lateral movement, reconnaissance, and data exfiltration. If Colonial had proper logging and a Security Operations Center (SOC) monitoring for unusual authentication patterns, unauthorized RDP connections, or large data transfers—they might have caught it.

5. Backup Integrity and Testing

Colonial’s CEO testified that the company’s backups weren’t reliable enough to restore from quickly. That’s a failure of backup hygiene.

Backups need to be:

• Offline: Air-gapped so ransomware can’t encrypt them
• Tested regularly: Restoration tests at least quarterly
• Immutable: Prevent modification or deletion
• Complete: Include both data and system configurations for rapid rebuild

If Colonial had reliable, tested backups, they might not have needed to pay the ransom at all.

6. Incident Response Planning—and Drilling

An incident response plan is just a document until you’ve actually tested it. Colonial appears to have made good decisions under pressure—shutting down the pipeline, containing the breach, engaging federal agencies—but the fact that they felt they needed to pay the ransom suggests gaps in their recovery options.

Organizations should:

• Develop OT-specific incident response playbooks
• Conduct tabletop exercises at least annually
• Practice manual operations in case control systems are compromised
• Include communication plans for stakeholders, regulators, and the public

7. Supply Chain and Third-Party Risk

The initial credential likely came from a breach at another organization. This highlights supply chain risk: your security is only as strong as your vendors, partners, and—in the case of reused passwords—your employees’ personal accounts.

Implementing vendor risk assessments, secure remote access policies for third parties, and continuous evaluation of supply chain vulnerabilities should be part of every critical infrastructure security program.

The Bottom Line

The Colonial Pipeline ransomware attack wasn’t a sophisticated hack in the traditional sense. There was no zero-day exploit, no nation-state-level tradecraft, no elaborate social engineering campaign.

It was a basic security failure that cascaded into a national emergency. A compromised password on an unused account. No multi-factor authentication. Poor network segmentation between IT and OT. Unreliable backups.

These are the fundamentals. The blocking and tackling of cybersecurity. And when they fail in critical infrastructure, the consequences are measured not just in dollars, but in disrupted supply chains, national emergencies, and public trust.

The lessons from Colonial Pipeline are clear. The question is: Have we actually learned them?

This article is part of acefortis.com’s ongoing coverage of major cybersecurity incidents. For more technical breakdowns of infamous data breaches, [subscribe to our newsletter].