Loading threat actor…
Dark Angels is a Russian-speaking cybercriminal ransomware and extortion group active since May 2022. It is also associated with the Dunghill or Dunghill Leak branding through its leak site infrastructure. The group is known for big-game hunting against a small number of high-value enterprise victims worldwide, favoring large-scale data theft and high-pressure extortion over indiscriminate campaigns. Public reporting links Dark Angels to the largest known ransomware payment on record in 2024, after the theft of a massive volume of corporate data from a Fortune 50 U.S. company. Dark Angels has used both encryption-based ransomware and data-theft extortion. In some intrusions it has stolen data and extorted victims without deploying a file-encrypting payload, while in other cases it has encrypted enterprise systems, including VMware ESXi environments. The group has been observed stealing data for leverage, threatening publication on its leak site, and pressuring victims with deadlines and threats to notify regulators, customers, or other third parties. This supports both encryption extortion and pure data-theft extortion models. Technically, Dark Angels has been linked first to Babuk-derived ransomware code and later to a Linux encryptor associated with Ragnar Locker. Reported capabilities include targeted enterprise intrusion, lateral movement, administrative takeover of Windows environments, encryption of local drives, network shares, mapped network paths, and ESXi-hosted systems, as well as service and process termination, shadow-copy deletion, and other recovery-inhibiting actions. The malware and operations have shown strong emphasis on selective targeting, post-compromise discovery, and maximizing operational impact before extortion. The group is not generally described as a ransomware-as-a-service operation and is instead characterized as a more tightly controlled, human-operated crew focused on fewer but larger victims. Known aliases and related naming include DarkAngels, darkangels, dark_angels, and Dunghill Leak group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operations described as using ESXi-specific variants and refined hypervisor targeting, including backup destruction and high-impact disruption.
Dark Angels is a ransomware group known for demanding and receiving large ransom payments, such as the reported $75 million, which has influenced the broader ransomware ecosystem to pursue higher payouts.
Conducting large-scale data theft and extortion operations, including theft of massive data volumes from major corporations.
Ransomware/extortion group associated in the content with a record-breaking $75 million ransom payment in H1 2024.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.