# Colonial Pipeline, Darkside and Models

DevFeed: [Colonial Pipeline, Darkside and Models](<https://devfeed.tech/articles/colonial-pipeline-darkside-and-models-36732.md>)

Original publisher: [Read original article](<https://shostack.org/blog/colonial-pipeline-darkside-and-models/>)

Author: Adam

Published: 2021-05-15T00:00:00Z

Content type: opinion

Language: en

Sources: [Shostack & Friends Blog](<https://devfeed.tech/sources/shostack-friends-blog.md>)

Topics: [incident](<https://devfeed.tech/topics/incident.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>), [data](<https://devfeed.tech/topics/data.md>)

Tags: [data](<https://devfeed.tech/tags/data.md>), [incident](<https://devfeed.tech/tags/incident.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [mapping](<https://devfeed.tech/tags/mapping.md>), [models](<https://devfeed.tech/tags/models.md>)

## AI overview

The article examines how Sophos and Mandiant model DarkSide activity in accounts of the Colonial Pipeline shutdown. It compares their kill-chain stages and lateral-movement data, noting substantial differences and questioning whether the available information is sufficiently comprehensive.

## Source excerpt

The Colonial Pipeline shutdown story is interesting in all sorts of ways, and I can't delve into all of it.I did want to talk about one small aspect, which is the way responders talk about Darkside.