Ransomware Group intelligence
D4rk4rmy
InactiveTrack D4rk4rmy with 19 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
D4rk4rmy is tracked by Breach House as a ransomware group with 19 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 2h ago | d4rkd2fybtclo44hss2dpqpw7gmofboxhruax2az3uejw7puxxbpkvqd.onion |
Top Activity Sectors (10)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue D4rk4rmy, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: d4rk4rmy executes PowerShell scripts to deploy payloads and evade detection.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: d4rk4rmy adds malicious registry run keys to maintain persistence across reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: d4rmy disables antivirus tools and modifies security utilities to ensure encryption proceeds undetected.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: d4rk4rmy deletes Volume Shadow Copies and temporary files to prevent data recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: d4rk4rmy uses network share discovery to locate victim file shares for encryption targets.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: d4rk4rmy uses SMB/Windows Admin Shares for lateral movement across networked systems.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: d4rk4rmy encrypts victim files and backups using strong symmetric encryption before demanding ransom.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: d4rk4rmy calls system recovery inhibitors to block restore processes and persistence mechanisms.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (19)
Search, filter and paginate the victim timeline for D4rk4rmy. Showing 1–19 of 19.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | THE MILLENNIUM GROUP id21772 View details | United States | Services | ||
|
https://www.tmgofficeservices.com The Millennium Group (TMG) is a global provider of document management and workplace services with more than 40 years of operations. TMG is certified as a Minority Business Enterprise (MBE) and a Woman-Owned Business Enterprise (WBE). The company operates… |
|||||
| Ransomware | VINSON & ELKINS LLP id21771 View details | United States | Finance / Legal / Insurance | ||
|
https://www.velaw.com Vinson & Elkins is a century-strong global law firm that partners with leading companies across key industries on wide‑ranging, complex matters. Blending deep experience with forward‑thinking counsel and close client collaboration, the firm helps organizations pursue goals and navigate… |
|||||
| Ransomware | MMA TRANSFERS id21698 View details | United Kingdom | Communication / Marketing | — | |
|
https://www.mmatransfers.com Founded in 2016, MMA Transfers began its operations with a single focus: providing reliable and professional airport transfers from Manchester to all destinations across the UK. The company has grown into one of the most recognized brands in the… |
|||||
| Ransomware | BRIDGEWATER ASSOCIATES id21599 View details | United States | Communication / Marketing | — | |
|
https://www.bridgewater.com Bridgewater Associates is a premier asset management firm, focused on delivering unique insight and partnership for the most sophisticated global institutional investors. Our investment process is driven by a tireless pursuit to understand how the world’s markets and economies… |
|||||
| Ransomware | MAGELLAN FINANCIAL GROUP id21598 View details | Australia | Finance / Legal / Insurance | — | |
|
https://www.magellangroup.com.au Founded in 2006 and headquartered in Australia, an active asset manager specializing in global equity and infrastructure strategies. they search the world for high-quality companies that we believe have a sustainable competitive advantage and will compound returns over the… |
|||||
| Ransomware | ONEX CANADA ASSET MANAGEMENT INC id21597 View details | Canada | Communication / Marketing | — | |
|
https://onex.com Onex Partners is a private equity platform focused on the upper-middle market in the United States, Canada, and Europe. Our successful track record is built on deep sector specialization and a disciplined, hands-on approach to private equity investing. they… |
|||||
| Ransomware | TSAI CAPITAL id21596 View details | United States | Finance / Legal / Insurance | — | |
|
https://tsaicapital.com Tsai Capital™ is an investment management firm focused on the preservation and long-term growth of capital on behalf of select families and organizations. With more than two decades of experience, and as a third-generation investor whose financial roots date… |
|||||
| Ransomware | MIZUHA FINANCIAL GROUP id21595 View details | Japan | Finance / Legal / Insurance | — | |
|
https://www.mizuhogroup.com In 2002, Dai–Ichi Kangyo Bank, Fuji Bank, and the Industrial Bank of Japan merged to form the Mizuho Financial Group. Since then, Mizuho has developed an extensive network in Asia and the rest of the world through a consistent… |
|||||
| Ransomware | CASINO DE MONTE-CARLO id21510 View details | Monaco | Communication / Marketing | ||
|
https://www.montecarlosbm.com/ Monte-Carlo Société des Bains de Mer (SBM) is a prestigious hospitality group founded in 1863, renowned for shaping Monaco’s identity as a global symbol of luxury and sophistication. The company operates a collection of iconic properties in Monte Carlo,… |
|||||
| Ransomware | DIMERCO id21508 View details | Taiwan, Province of China | Transportation / Travel / Logistics | ||
|
https://dimerco.com international freight forwarder and logistics company, Dimerco trade compliance and contract logistics services to make global supply chains more effective and efficient. The majority of DIMERCO global shipping projects connect Asia’s logistics and manufacturing hubs with each other and… |
|||||
| Ransomware | BIG ROCK RESORT id21507 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
https://www.bigrockresort.net/ Big Rock Resort features the only truly lakefront cabins in June Lake, CA. 8 fantastic cabins to choose from that accommodate individuals, couples, families, family reunions, weddings, and corporate retreats. Including 1, 1 bedroom cabin, 6, 2 bedroom cabins… |
|||||
| Ransomware | MONTE-CARLO id21506 View details | Monaco | Communication / Marketing | ||
|
Monte-Carlo Société des Bains de Mer operates from Monaco and is a long-established resort group centered on hospitality, gaming, and luxury leisure. Its website presents hotels, restaurants, casinos, spas, event services, and related resort experiences for visitors in Monaco. The company also maintains corporate and contact information for guest services, reservations, and marketing through its official site. It was listed as a ransomware victim associated with d4rk4rmy. |
|||||
| Ransomware | Digitall Evolution id21396 View details | Brazil | IT | ||
|
https://www.digitallevolution.com.br Digital Marketing Agency and SEO with national action Experts in SEO, performance marketing and digital visibility A Digitall Evolution it was born to revolutionize the market of digital marketing agencies in Brazil. Our trajectory is marked by innovation, transparency and concrete results, passionate about… |
|||||
| Ransomware | VINHAS E REDENSCHI ADVOGADOS id21395 View details | Brazil | Services | ||
|
https://vradv.com.br Specialized in Business Law, We act as partners of customers, offering creative strategies and sustainable for the business growth. We have been in Rio de Janeiro and Sao Paulo since 2002, with a team of highly qualified professionals, specialized and recognized in the most diverse areas of Law.… |
|||||
| Ransomware | BIG SILVER id21051 View details | Thailand | Manufacturing / Engineering | — | |
|
https://bigsilvermanu.com Big Silver was established as a small company in 1993 in a part of Bangkok, the capital of Thailand. With Italian machinery, updated technology, and proper know-how: these fundamental factors make Big Silver worldwide accepted in the field of… |
|||||
| Ransomware | MAFATE BUSINESS ENTERPRISE id21050 View details | South Africa | Communication / Marketing | — | |
|
https://mafate.co.za It was established at Steelport, under the entrepreneurial spirit of its Director Mr Mahlaka Lucas Makuwa in the year 2002. it is a competent and competitive black owned Mining supply Company that delivers quality products and services into the local… |
|||||
| Ransomware | University of Puerto RicoRío Piedras Campus id21049 View details | Puerto Rico | Education | — | |
|
https://www.uprrp.edu The University of Puerto Rico Río Piedras Campus is the oldest and largest higher learning institution in the Caribbean. Founded in 1903, the Río Piedras Campus stands out for its academic excellence, its diverse academic offerings, and its vibrant… |
|||||
| Ransomware | Taiwan Digital Streaming Co Ltd id21045 View details | Taiwan, Province of China | Telecommunications | — | |
|
https://www.twds.com.tw Provide network access services, providing the most suitable network access solutions from different specifications of network requirements, network environment, etc. At the same time, network stress testing services are also provided to ensure that your network can withstand high… |
|||||
| Ransomware | ELZAB id21044 View details | Poland | Construction / Real Estate | — | |
|
https://www.elzab.com.pl From the first Polish minicomputer to electric car charging stations and responsive web applications. Silesian reliability, European design, recognizable brand among fiscal devices. ELZAB from ELZAB Street. 50 years of tradition of innovative constructions that have changed the course… |
|||||