Colonial Pipeline reportedly paid $5 million to the hackers before announcing it would restart its operations again. DarkSide operates via a "ransomware-as-a-service" business model, developing and selling malware to be used by other cyber criminals. It was reported that over 99 organizations were infected with its software, suggesting just under half of all victims paid ransom. Last week, Biden claimed that the hackers appeared to be based in Russia but were not employed by the Russian government.

KEY FACTS

London-based blockchain analytics firm Elliptic said in a report t it had identified the bitcoin wallet being used by DarkSide—a hacker group believed to be based out of Eastern Europe—to collect ransom from its victims, including the Colonial Pipeline. 

The wallet showed over $90 million in bitcoin ransom payments were made to DarkSide over the past nine months from 47 victims, with the average payment to the group likely totaling $1.9 million, according to Elliptic.