Ransomware Group intelligence

Dagonlocker

Active

Track Dagonlocker with 0 published victims and 1 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 0 Known published victims in this dataset

First discovered Unknown Earliest victim discovery date

Last discovered Unknown Latest victim discovery date

Known locations 1 Leak or negotiation infrastructure tracked

Dagonlocker is tracked by Breach House as a ransomware group with 0 published victims.

The group is tracked across multiple victim records in the Breach House dataset.

1 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 1	Onion service	Down checked 8h ago	`dgnh6p5uq234zry7qx7bh73hj5ht3jqisgfet6s7j7uyas5i46xfdkyd.onion`

No sector intelligence available.

Typical Attacks (8)

▼

MITRE ATT&CK does not currently catalogue Dagonlocker, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: dagonlocker uses PowerShell scripts to execute malicious commands and payload deployment across compromised systems.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1685 Disable or Modify Tools Defense Impairment

What they do: dagonlocker disables antivirus tools and security software to evade detection during infection phases.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1070.004 File Deletion Stealth

What they do: dagonlocker deletes Volume Shadow Copies and backup files to prevent recovery from restore operations.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1018 Remote System Discovery Discovery

What they do: dagonlocker performs remote system discovery to locate additional targets within the victim network.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1135 Network Share Discovery Discovery

What they do: dagonlocker scans network shares to identify victim hosts and map lateral movement targets.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: dagonlocker leverages SMB/Windows Admin Shares for lateral movement between networked machines.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1486 Data Encrypted for Impact Impact

What they do: dagonlocker encrypts victim files and data using its ransomware payload to achieve impact.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1490 Inhibit System Recovery Impact

What they do: dagonlocker invokes system recovery inhibition mechanisms to prevent victim systems from restoring functionality.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Tools Observed (8)

▼

Software Dagonlocker has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery & enumeration

AdFind Nbtscan Seatbelt ShareFinder SoftPerfect NetScan

Exfiltration

RClone

Offensive security tooling

Cobalt Strike

Remote monitoring & management

AnyDesk

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Ransom Notes (1)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

dagonlocker.html html · 5212 chars

<!DOCTYPE html lang="en">
   <head>
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width, initial-scale=1.0, shrink-to-fit=no">
      <title>Pwned by DAGON Locker</title>
      <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAABhWlDQ1BJQ0MgcHJvZmlsZQAAKJF9kT1Iw0AcxV/TSkUqohYRcQhSnSyIijhKFYtgobQVWnUwufQLmjQkKS6OgmvBwY/FqoOLs64OroIg+AHi6OSk6CIl/i8ptIj14Lgf7+497t4BQq3EVNM3AaiaZSSiETGdWRX9r/ChDwPoxYjETD2WXEyh7fi6h4evd2Ge1f7cn6NbyZoM8IjEc0w3LOIN4plNS+e8TxxkBUkhPiceN+iCxI9cl11+45x3WOCZQSOVmCcOEov5FpZbmBUMlXiaOKSoGuULaZcVzluc1VKFNe7JXxjIaitJrtMcRhRLiCEOETIqKKIEC2FaNVJMJGg/0sY/5Pjj5JLJVQQjxwLKUCE5fvA/+N2tmZuadJMCEaDjxbY/RgH/LlCv2vb3sW3XTwDvM3ClNf3lGjD7SXq1qYWOgJ5t4OK6qcl7wOUOMPikS4bkSF6aQi4HvJ/RN2WA/luga83trbGP0wcgRV0t3wAHh8BYnrLX27y7s7W3f880+vsBfKdyq3K9C9gAAAAGYktHRAD/AP8A/6C9p5MAAAAJcEhZcwAACxIAAAsSAdLdfvwAAAAHdElNRQfmBBMTMSax1ZPoAAAAGXRFWHRDb21tZW50AENyZWF0ZWQgd2l0aCBHSU1QV4EOFwAABXpJREFUeNrtm0toFFkUhr9bVd1d3WljlFF0nMmMQZCABGYwGElEF1m4iCASshLdJBJBF+4EcSESXLhzoRvDKIpk484EceMbgruAo6KDjBCSIYkRTb/qeWdRSfphxH5UrE46B2pT3XXqnv+ce151rvgXJBWQEo+DEKxU0uwKGYhMBhGPg+uuSACUShlI2wbLWrEWoPjBxE2nV+w28AUAXBdpmisSBMUvRjKTqW0AkBKZTK44EBQ/mUnLAilrFwAAmUh83wqk/PoKKg/wHQDXBdtGaFq+YI6DtG1cw0AAuRDJ+UsoCkLXEar6w7aSthxMZTKJWL/e8wu2jZtOo3Z2Et23j/q9ewnv3Im2desiSM7sLNaHDySfPiXx7h3W1asIVUXRdVDVZQVA/FNhKvxNCoXAsggdOcKmc+fQW1o8gYsIqa5lMTMwwNydO4jxcUQ4vGwWsSwASMBtamLb7dvEWluLE3wJcubmmOjpwXzwACUWA0WpfgBcQG1upvHRI7TNm5d0gPbEBKknT7CnpxG6jt7cTLS93dNygaalbTN7/TqfTp1CjUZ9B8FXACSgtrXx++PHntnmkPX+PTMjI6TOnvV8BHjCzjtKCYR7e9lw6BDrurryBZWSL8+fM7V/P2pdna/bwTcAJCBbWmh6+BB148bsfcNg+sYNvvT3o4TD2f1cKISUYNs46TSh9na23rpFePv2vCgyNTDA3IULXglebQA4wC+jo8T27Mne+/iR8ePHse7fR43FitacNAwcw2BbAT9pWbw/eBAxOlq2X1mWREgCkb4+Yq2teYudOH8ec3gY4bolma2IRNBiMSba2si8fJm9Hwrx88AAMpWqsnIY2HT0aN6+/XjzJulr17wXSFl6saRpKLrOZE9PXrNF370btbMTbLt6AFC3bCHW0ZHVvuPwqa+P3BRGmmbJXSMRDuO8fs2noaHsPU0jduAArk9NGMUX8z92LE+7X4aGlnQsbhnVohqNkhgezkur13d1eYVXtViA1tSUFUxKkq9eLc3YdUvvHaoq1t27eQBEWlp8i93+ZBW5WpUSe2rq2/4ikSiZtzQMz3py3iGqCoDCxohpfv/3UpOZgv+Lhdyh6gAotn1W4eJl1VpAsaEzlaqK9llgAGDbXvMkYBCUQN+e69hWEwDF5unSdZGGUZQVFPL0y24qqijkfBqcvneP/yYnvb4eYI6N4Ra7yEwGtYikZvry5UXHp6iqV31mMohIpKIeQdnVoARiZ87Q0N/v7eVC7RShVSuZxNI0hJTI7/xfOk42cgiB0DTct29JdHcj6ut/PAAOsO3FC+pyKsBSyZiZwZhvnpa8cIBwmBkhIB4v2woqK6orjeW2jTRNhOOU/qwQCB8iSLBRoApoDYA1ANYAWAMgMBK6jtB10LTAagItKOFnR0ZIT0wgGhqo+/MPlF8bfSmTqx8A12X8xAlSg4OL5pcCNr3+G/FbE1jm6t4Cxps3JAcHUeezuQXDnx38CxEJr34fYE9OflUkCUB+/hzIsOUPByDa0YFobMwrQFwgumtXbUQBJRJh+9gYyo4dXkmradRfuUL85EnPCdZCGNQaGvjp0iVcIHT4MPHTp8v6crSi8wCZMxcgpQxs2Dr4TDDgucK1VLgaNC9qFQAJYFm4AU6LBlYL1Hd3E5mexoxGAz1wERgAQlW9cwaKAoZRo06wnHmBtSiwBsD8HhK+RBDNj0WU/fh8R0iU82FECMTCx5AKPo2VDYAKTPX2suHiRW8OsFQhhMBJJjFzxmVLW7mG8+wZFqAunE8oRwmVToouHHYo2wr8eFZRUNatKwvIisOgCDiTW4gm0jS9OeQSQVg1UUCm02VZwKoKg+XMHa2uPMC2a3cLLFpBMcf2cuh/hJA8cuvOr0QAAAAASUVORK5CYII=">
      <link rel="stylesheet" href="https://bootstrapstudio.io/demo//embed//bootstrap/5/default/bootstrap.min.css">
   </head>
   <body>
      <div class="container py-4 py-xl-5">
         <div class="row mb-5">
            <div class="col-md-8 col-xl-6 text-center mx-auto">
               <section class="py-4 py-xl-5">
                  <div class="container">
                     <div class="text-white bg-dark border rounded border-0 p-4 p-md-5">
                        <h2 class="fw-bold text-white mb-3"><span style="color: rgb(255, 0, 0);">Pwned</span><br></h2>
                        <h2 class="fw-bold text-white mb-3"><span style="color: rgb(255, 0, 0);">by DAGON LOCKER</span></h2>
                     </div>
                  </div>
               </section>
            </div>
         </div>
         <div class="row gy-4 row-cols-1 row-cols-md-2 row-cols-xl-3">
            <div class="col">
               <div class="p-4">
                  <span class="badge rounded-pill bg-primary mb-2"></span>
                  <h4>What happened?</h4>
                  <p>All your data is encrypted on all IT systems.<br></p>
                  <p>Your data including financial, customer, partner contracts and employees has been exfiltrated to our internal servers.<br></p>
               </div>
            </div>
            <div class="col">
               <div class="p-4">
                  <span class="badge rounded-pill bg-primary mb-2"></span>
                  <h4>What's next?</h4>
                  <p>You either get in touch with us or get famouse as a company with a large data leak.<br></p>
               </div>
            </div>
            <div class="col">
               <div class="p-4">
                  <span class="badge rounded-pill bg-primary mb-2"></span>
                  <h4>How do I recover?</h4>
                  <p>There is no way to decrypt your files manually unless we provide a special decryption tool.<br></p>
                  <p>Get your copy of <a href="https://www.torproject.org"><span style="color: rgb(255, 0, 0);">Tor browser</span></a> and <a href="http://dgnh6p5uq234zry7qx7bh73hj5ht3jqisgfet6s7j7uyas5i46xfdkyd.onion/?cid=[snip]"><span style="color: rgb(255, 0, 0);">CONTACT US</span></a><br></p>
               </div>
            </div>
         </div>
      </div>
   </body>
</html>

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Type	Target	Discovered	Country	Business Category	Intel Link

No victims found for the selected filters.

Dagonlocker

Overview

Top Countries

Known Leak Locations (1)

Top Activity Sectors