Those of you on the East Coast have my sympathy. Your gas prices (when you can even get it) are going to be through the roof. Here's a good article on what happened and what's currently being done.
https://www.npr.org/2021/05/10/995405459...al-u-s-pipeline

It attack isn't at all surprising. Similar ransomware attacks have shut down hospitals and even cities. It's one more thing you need to keep in mind. My brother used to be in charge of the IT security for a powerplant up in Alaska and he said back eight years ago they were attacked multiple times per day. I'm sure it's even worse now.
-Blast

Please note that while I work in this field I am not involved in this investigation in any way; all I know about the attack is what's been reported publicly.

Historically, most nation-state threat actors do not use ransomware. Almost all ransomware threat actors are financially motivated. If this attack were targeted at the pipeline company, I would have expected the attacker to take measures to be sure to get paid, rather than shut down the pipeline.

Based on what I know so far, I don't think that this specific threat actor is particularly low or high in sophistication. A low sophistication threat actor would have had challenges attacking these systems. A high sophistication threat actor would be attacking financial systems, or similar activity that has a higher percentage of success.

In other words, the threat actor probably regrets this attack due to not getting paid for success and due to the extra attention they will receive from law enforcement and private entities that work on attribution.

Seems the attackers didn't shut down the pipeline, but was shutdown as a "precautionary measure".

It seems Colonial's automatic invoicing system has been affected. So they can't invoice their clients.

https://zetter.substack.com/p/biden-declares-state-of-emergency

I have been reading Brian Kreb's blog for years due to the in-depth and knowledge he has on many different types of security issues. His latest post is on the Colonial Pipeline ransomware attack and is a very good (and long) read.

https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/#more-55529

Krebs is freaking awesome.

It appears Colonial's website is fubar. Throwing 502s and also advertising it's using a 3 year old version of nginx. *facepalm*

Yes, I imagine being reclassified from "criminal nuisance" to "terrorist actor" could introduce all sorts of pesky complications into one's business plan.

Story update

https://www.bloomberg.com/news/articles/...llion-in-ransom

Seems Colonial paid $5 million ransom.

Well, that will certainly discourage future attacks.

Good article, thank you Ren.

With regard to paying ransoms, I personally oppose it.

Many companies don't have a comprehensive incident response plan, one that goes beyond IT to include Legal, Public Relations, other internal stakeholders, and external stakeholders like business partners and law enforcement. In these events, companies are learning as they go. Often those lessons are quite a bit more painful without a plan.

I don't know about the victim in this case, but if we suppose for the sake of the argument that they had an excellent plan including all relevant stakeholders, I imagine their thinking could have gone like this:

• We're losing $BIGNUM per hour
• The ransom will save us way more money than it will cost
• We're obligated to our shareholders to stop the losses

Barring a Board of Directors policy forbidding the payment of ransom, the executive leadership of the victim company may very well feel legally compelled to pay it to preserve shareholder value.