DarkSide Attack Shuts Down U.S. Fuel Pipeline

**Executive summary:** This report analyzes the DarkSide ransomware and its May 2021 attack against Colonial Pipeline, detailing its human-operated RaaS model, double-extortion behavior, technical operations (VSS/VMVSS disabling, custom file extensions derived from MachineGuid, PowerShell-based shadow copy deletion, mutex usage), observable indicators (file hash and multiple C2 IPs/domains), MITRE ATT&CK mappings, and recommended mitigations to reduce impact.