The ransomware attack against Colonial Pipeline resulted in the shutting down of DarkSide ransomware, which had claimed responsibility for the attack, noted Peter Mackenzie, director of incident response at Sophos. This then resulted in DarkSide returning under the new name of BlackMatter shortly after. While the name was different, the core ransomware code was not, and it had the same weaknesses that allowed free decrypters to be produced. In October, Emsisoft announced they had a decrypter for BlackMatter and had been secretly helping victims.