DarkSide ran ransomware like a franchise — tiered cuts, affiliates, a helpdesk (interview)

On NPR’s Fresh Air in June 2021, New York Times investigative reporter Michael Schwirtz described what he found inside the internal communications of DarkSide, the Russian-speaking ransomware operation that attacked Colonial Pipeline and pulled in more than $90 million in roughly its first year since launching in August 2020. The ransom note victims saw began “Welcome to DarkSide” — formal, businesslike, with subtle threats not to tamper with their own systems. Beyond encrypting files, the gang stole proprietary data and threatened to release it publicly or sell it to rivals and other hackers.

DarkSide was structured like a franchise. It wrote the ransomware but contracted out the actual intrusions to affiliates — other hackers who signed on to use the malware for a fee on a sliding scale tied to the ransom size. A ransom under $500,000 left DarkSide about 25%; on ransoms over $5 million its share slid to about 10%, a split described as fairly generous. On Colonial Pipeline’s $4.5 million payment, roughly 10% went to DarkSide and the rest to the affiliate who penetrated the systems. The gang recruited on dark-web forums, one of dozens of groups competing for skilled affiliates.

Even the victim experience was productized. Most victims did not know how to use Bitcoin, so DarkSide ran a helpdesk — with chat, like an internet provider’s support line — to walk them through paying. The goal, Schwirtz said, was to make paying as simple as possible so victims would clear the problem and move on rather than fight to recover their data. When DarkSide was identified as the Colonial Pipeline attacker, it went dark.

Splitting roles let specialists specialize: the malware authors scaled one product across dozens of affiliates working around the clock to find victims.

The regressive commission — a smaller cut on bigger ransoms — was designed to attract and keep the most capable hackers.

A helpdesk that eases payment removes friction; a confused victim is an unpaid ransom.

Stealing data as well as encrypting it added a second, public pressure channel beyond lost access.

Criminal markets industrialize the same way legal software did — franchising, tiered SaaS pricing, support desks — and mapping that structure is how investigators understand the threat.

After being outed as the Colonial Pipeline attacker — an attack that disrupted the flow of gas in the US — DarkSide went dark. Schwirtz also reported on REvil, the group behind the attack on meat processor JBS, part of the same wave of ransomware hitting companies, hospitals, police and cities.