Loading threat actor…
DoNex is a financially motivated ransomware group that emerged in early 2024 after the disappearance of Darkrace. Its malware is widely assessed as a LockBit-derived strain and also closely resembles Darkrace, indicating substantial code reuse from the leaked LockBit builder ecosystem rather than novel development. DoNex has targeted organizations in the United States and Europe. DoNex ransomware is a Windows-focused family that performs standard pre-encryption preparation, including single-instance enforcement, privilege checks, WOW64 file system redirection handling, cryptographic context initialization, and modification of file-type presentation for encrypted data. It deploys helper components to terminate security, endpoint detection, and backup-related processes, and it interacts with the Service Control Manager to stop services that may interfere with encryption. Operationally, DoNex enumerates local drives and accessible network shares, identifies files for encryption while excluding selected system-critical files, and uses Windows Restart Manager functionality to identify and terminate processes locking target files. After encrypting data, it drops ransom notes, clears Windows event logs, removes temporary helper artifacts, and forces a system restart. The group’s tradecraft demonstrates defense evasion, post-compromise disruption of protective tooling, and encryption of both local and network-accessible data. A public decryptor has been released for some DoNex victims.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DoNex is a financially motivated ransomware group active since early 2024, targeting US and European organizations. A decryptor is available for its victims.
Ransomware group using a LockBit-derived code base via similarities to Darkrace, conducting file encryption on local drives and accessible network shares, killing processes, stopping services, clearing event logs, and dropping ransom notes.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.