The dAn0n Hacker Group emerged in April 2024 and appears to function more as a data broker group than a traditional ransomware gang, with a public data-leak presence across clearnet and TOR. They list 13 victims predominantly in the United States across multiple sectors, illustrating a shifting ransomware/data-broker landscape shaped by global law enforcement activity. #dAn0nHackerGroup #DataLeakSite #DataBroker #LockBit #SOCRadar
Keypoints
- The dAn0n Hacker Group emerged at the end of April 2024 and has published information about 13 victims on its data leak site (DLS).
- They may operate as both a data broker and ransomware-facing actor, but evidence of actual ransomware activity is not yet substantiated.
- Initial access is reportedly gained via phishing emails, followed by deployment of custom ransomware binaries and obfuscated scripts to execute payloads.
- Victimology shows 13 companies affected, with 12 in the United States and 1 in Ireland, spanning sectors such as healthcare, legal, insurance, and construction.
- The DLS publicly shares victim data, including status updates and negotiations, with files receiving substantial views (e.g., over 60 thousand views).
- While some group references describe ransomware activity, the article notes that the term “ransomware group” may be used loosely by the cybersecurity community for data-extortion actors.
- Mitigation guidance emphasizes data classification/encryption, least-privilege access, network segmentation, employee training, incident response planning, backups, and third-party risk management, with SOCRadar highlighted as a detection/response aid.
MITRE Techniques
- [T1566] Phishing – ‘to gain initial access, the group uses phishing emails’ to obtain entry before payload delivery.
- [T1027] Obfuscated/Compressed Files and Information – ‘deploys custom ransomware binaries and obfuscated scripts to execute their payload’ to evade detection and run their code.
- [T1068] Privilege Escalation – ‘They employ tactics such as privilege escalation and defense evasion to maintain persistence and avoid detection.’
Indicators of Compromise
- [Email] Data leak site contact – an e-mail address listed on the DLS.
Read more: https://socradar.io/dark-web-profile-dan0n-hacker-group/