So in the previous video we spoke about motivations.
I couldn't wait to talk about the Colonial Pipeline attack of 2021 in the United States.
Let's talk about this attack and let's borrow through all of the misconceptions and just rumors and
false facts that are out there about this particular attack.
And we'll get to the bottom of it and find out what the motivation was.
The Colonial Pipeline attack in 2021 here in the United States occurred on April 29th, and this was
a big deal.
The pipeline was shut down and there were, you know, lines at the pumps in the East Coast here in
a bit of a panic.
And, of course, price increases when the Colonial Pipeline was shut down.
In fact, it was the first time in 75 years or something like that that they had ever shut down the
pipeline.
So this was a huge deal.
As you might guess, one of the rumors that quickly spread was that this was some type of an Iot attack
that attackers, hackers that is, had managed to get in and shut down the pipeline.
This is not true.
No, the colonial pipeline people, the C-suite executives said her down once they realized that this
computer attack was spreading through their networks.
So they didn't want to run the risk that the hackers would gain control of the pipeline.
So how did it happen?
Well, unbelievable.
There was an account on the Colonial Pipeline Network that had remote access capabilities through a
VPN and privileges.
Once it got on the inside and someone had set this password identical to their own personal password,
they got leaked on the dark web.
The only thing investigators still don't fully have a grasp on is how did they associate that password
that was leaked with the username that had the credentials inside the Colonial Pipeline?
So that was an interesting piece of the puzzle.
And they found absolutely no evidence of social engineering, which made this particular attack quite
unique since social engineering is typically step one in a lot of these types of attacks.
Well, what happened on May 7th, 2021, a ransom note appeared after they were in, they fired up a
ransom note and they wanted 4.4 million for the 100 gig of data that they were in possession of.
Imagine that.
So what was the motivation in this attack?
It was money payable via Bitcoin checking, and that's exactly what the Colonial Pipeline did.
So notice this attack began April 29th.
May 7th.
Right.
Not long later, just over a week later, they are paying 4.4 million and they did pay it to gain access
to their 100 gigs of data.
The culprits, a faction of the Russian group called Darkside.
So a group within Darkside carried out this successful attack against the Colonial Pipeline.
It did shut down the pipeline, but not directly.
The Colonial Pipeline was shut down by the folks that own it in in result of this good old fashioned
breach into the network, thanks to a duplicate password.
So someone using a personal password that's identical to the password on a key system password.
One other note, by the way, the Colonial Pipeline I.T. staff really dropped the ball here because
that remote access potential VPN account, that was the culprit.
That account was no longer being used, but of course, they had not properly disabled or deleted that
account.
Shame on them.
And it was certainly a costly mistake.