One leaked password. No multi-factor authentication. Nine days undetected.

In May 2021, a compromised VPN credential — found on the dark web, tied to a former employee's account, protected by nothing more than a single password — gave DarkSide ransomware operators access to Colonial Pipeline's IT network. What followed: 100 gigabytes of stolen data, encrypted systems, a $4.4 million Bitcoin ransom, a six-day shutdown of 5,500 miles of fuel infrastructure, and a DOJ operation that clawed back 63.7 of the 75 Bitcoin using a method that remains partially redacted from the public record.

This episode traces the complete chain: the entry vector, the nine-day dwell time, the franchise model behind DarkSide, the IT/OT boundary decision that shut down physically intact infrastructure, the ransom payment calculus, and the regulatory reckoning that followed.

Primary sources: Senate testimony, CISA advisory, FBI seizure affidavit, GAO report.

Free PDF breakdown: https://zerodaylogs.com

00:00 — The Escalation
01:30 — Introduction
01:35 — What Is a VPN?
02:39 — The Forgotten Door
03:34 — One Password, No Second Factor
04:40 — DarkSide: Ransomware-as-a-Service
05:39 — Anatomy of the Attack
07:29 — 100 Gigabytes Out the Door
08:34 — Two Buildings, One Boundary
11:12 — Seventy Minutes
11:44 — The Shutdown Decision
13:08 — The $4.4 Million Question
14:02 — The Vault
15:10 — The DOJ Strikes Back
15:54 — Three Missing Controls
17:55 — Eleven Years Without an Update
18:21 — The Aftermath