Colonial Pipeline Ransomware Attack: What we know so far

On 07 May 2021 the Colonial Pipeline network was impacted by a DarkSide ransomware attack that forced the company to halt operations and disrupted fuel distribution on the U.S. East Coast; the FBI later attributed the incident to DarkSide. The report summarizes the incident, likely initial access vectors (including possible IAB-supplied RDP access), the national-level operational impact and emergency responses, and provides mitigation guidance for IT/OT security to reduce similar risks to critical infrastructure.