weak servers. The malware uses a Remote Desktop Protocol brute-force attack to guess weak passwords until one is broken. The virus has been behind attacks on government and healthcare targets, with notable hacks occurring against the town of Farmington, New Mexico, the Colorado Department of Transportation, Davidson County, North Carolina, and most recently, a ransomware attack on the infrastructure of Atlanta. Mohammad Mehdi Shah Mansouri (born in Qom, Iran in 1991) and Faramarz Shahi Savandi (born in Shiraz, Iran, in 1984) are wanted by the FBI for allegedly launching SamSam ransomware. The two have allegedly made $6 million from extortion and caused over $30 million in damages using the malware. DarkSide On May 7, 2021 a cyberattack was executed on the US Colonial Pipeline. The Federal Bureau of Investigation identified DarkSide as the perpetrator of the Colonial Pipeline ransomware attack, perpetrated by malicious code, that led to a voluntary shutdown of the main pipeline supplying 45% of fuel to the East Coast of the United States. The attack was described as the worst cyberattack to date on U.S. critical infrastructure. DarkSide successfully extorted about 75 Bitcoin (almost US$5 million) from Colonial Pipeline. U.S. officials are investigating whether the attack was purely criminal or took place with the involvement of the Russian government or another state sponsor. Following the attack, DarkSide posted a statement claiming that "We are apolitical, we do not participate in geopolitics...Our goal is to make money and not creating problems for society." On May 10, SentinelOne published an analysis of the DarkSide Ransomware attack. In May 2021, the FBI and Cybersecurity and Infrastructure Security Agency issued a joint alert urging the owners and operators of critical infrastructure to take certain steps to reduce their vulnerability to DarkSide ransomware and ransomware in general. Syskey Syskey is a utility that was included with Windows NT-based operating systems to encrypt the user account database, optionally with a password. The tool has sometimes been effectively used as ransomware during technical support scams—where a caller with remote access to the computer may use the tool to lock the user out of their computer with a password known only to them. Syskey was removed from later versions of Windows 10 and Windows Server in 2017, due to being obsolete and "known to be used by hackers as part of ransomware scams". Ransomware-as-a-service Ransomware-as-a-service (RaaS) became a notable method after the Russia-based or Russian-speaking