Lessons Learned from Telemetry Analysis of DarkSide Affiliate Exfiltration Operations

This analysis details a DarkSide RaaS affiliate campaign that executed coordinated data exfiltration via SFTP/SSH to a leased VPS and likely deployed DarkSide ransomware to multiple victims — notably Colonial Pipeline and Brenntag subsidiaries — resulting in significant operational impact and multi-million-dollar ransom payments; telemetry showed large-volume transfers, Tor-based communications likely used for C2 or ransom negotiation, and opportunities for mitigation via DLP and web filtering.