Ransomware Group intelligence
dAn0n
InactiveTrack dAn0n with 33 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
dAn0n is tracked by Breach House as a ransomware group with 33 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
33
- Leaked 1 3.0%
- Pending 32 97.0%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 29m ago | 2c7nd54guzi6xhjyqrj5kdkrq2ngm2u3e6oy4nfhn3wm3r54ul2utiqd.onion |
Top Activity Sectors (11)
Typical Attacks (9)
▼MITRE ATT&CK does not currently catalogue dAn0n, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: dAn0n executes PowerShell scripts to automate initial payload deployment and system reconnaissance.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: dAn0n leverages registry run keys to ensure malware execution upon system startup.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: dAn0n disables antivirus tools and security processes to prevent detection and hinder incident response.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.016 Junk Code Insertion Stealth
What they do: dAn0n inserts junk code into binaries to evade static analysis and detection tools.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: dAn0n deletes Volume Shadow Copies and backup directories to maximize data loss and pressure victims.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: dAn0n uses network share discovery to locate victim file shares and identify high-value data for exfiltration.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: dAn0n uses SMB/Windows Admin Shares for lateral movement across networked hosts.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: dAn0n encrypts victim files using strong symmetric encryption to cripple operational continuity.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1491.001 Internal Defacement Impact
What they do: dAn0n performs internal defacement by replacing victim files with ransom notes or altered content.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Victims (33)
Search, filter and paginate the victim timeline for dAn0n. Showing 1–33 of 33.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | www.seaeng.com id13959 View details | Korea, Republic of | Manufacturing / Engineering | pending | ||
|
tahly Engineering & Associates, Inc. was established in 1970. The firm is headquartered in Helena, Montana with a branch office in Bozeman, Montana. Employees provide service in the fields of transpor... |
||||||
| Ransomware | mmtransport.com id13826 View details | United States | Transportation / Travel / Logistics | pending | ||
|
M&M Transport Services, Inc. was founded in 1990 by Mark R. Warsofsky and has steadily grown into a nationwide, dedicated transportation provider f or some of the biggest retail, manufacturing, distri... |
||||||
| Ransomware | www.dunnsolutions.com id13748 View details | United States | Services | pending | ||
|
Dunn Solutions Group is a digital commerce and business transformation consultancy that helps its clients achieve speed by automation. Acquisitions & Subsidiaries: Kaar Technologies.The total size of ... |
||||||
| Ransomware | thesourcinggroup.com id13478 View details | United States | Communication / Marketing | — | pending | |
|
The Sourcing Group (TSG) is a leading business process outsourcing service (BPO) provider recognized for commitment to customer satisfaction. Acquisitions & Subsidiaries: ImageX, Ray Hough, Carpe Die... |
||||||
| Ransomware | promarkbrands.com id13187 View details | United States | Communication / Marketing | — | pending | |
|
Leading manufacturer and distributor of a complete line of pro and semi-pro photo, video and audio equipment and accessories based in the Chicago S Uburbs in a modern 100,000 sq ft facility, promarks ... |
||||||
| Ransomware | fifcousa.com id13036 View details | United States | Retail / E-commerce | — | pending | |
|
Founded in 2009, FIFCO USA, owns and operates breweries and retail locations in New York, Vermont, Oregon, and Washington. Their headquarters is inRochester, New York. Subsidiaries and affiliates: La... |
||||||
| Ransomware | pedsurology.com id12764 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 740 GB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients was also receiv... |
||||||
| Ransomware | theblakefirm.com id12763 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 740 GB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients was also receiv... |
||||||
| Ransomware | ueg1.com id12762 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 300GB. This leak contains customer data, corporate information, databases, employee data, and customer insurance. |
||||||
| Ransomware | allenblastingandcoating.com id12761 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 1TB. This leak contains corporate information of the company: Financial, legal, information on employees, partners and clients. |
||||||
| Ransomware | semilab.com id12760 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 1.47TB. This leak contains corporate information of the company: Financial, legal, information on employees, partners and clientsб drawingы and scheme of constr... |
||||||
| Ransomware | fightingforfairness.com id12759 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 6 TB. This leak contains corporate information of the company: Financial, legal, medical information of clients and employees, personal data employees, partners... |
||||||
| Ransomware | oconnellmahon.ie id12758 View details | Ireland | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 1TB. This leak contains corporate information of the company: Financial and legal documents, architectural projects, personal data of employees, partners and cl... |
||||||
| Ransomware | ekiconsult.com id12757 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 1TB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients was also received:... |
||||||
| Ransomware | iiexperts.com id12756 View details | United States | IT | pending | ||
|
Information Integration Experts, LLC (iiExperts aka IIX) has been developing software since the early 1970s. Headquartered in Arlington, Texas, IIXbegan operations in 1980, and has been serving the ... |
||||||
| Ransomware | neosmteam.com id12755 View details | United States | Healthcare / Pharma | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | glenwoodnyc.com id12754 View details | United States | Communication / Marketing | pending | ||
|
Glenwood Management is a property management company, providing luxury apartments throughout New York. The total size of stolen information is 1.78TB. |
||||||
| Ransomware | s-f-concrete.com id12753 View details | United States | Healthcare / Pharma | pending | ||
|
S&F Concrete Contractors, Inc. is committed to being an industry leader in safety and health by setting agressive goals and continually measuring our performance. We will continually work to achieve a... |
||||||
| Ransomware | college-park.com id12752 View details | United States | Education | pending | ||
|
College Park Industries is a is a prosthetics manufacturing company. It design and manufacture a full line of anatomically correct, customizable prosthetic foot systems, upper limb solutions, endoskel... |
||||||
| Ransomware | Pediatric Urology Associates id12703 View details | United States | Other | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | S&F Concrete Contractors id12702 View details | United States | Construction / Real Estate | pending | ||
|
No additional victim description available. |
||||||
| Ransomware | Northeast Orthopedics and Sports Medicine id12396 View details | United States | Healthcare / Pharma | pending | ||
|
Northeast Orthopedics and Sports Medicine is a company that operates in the Hospital & Health Care industry. The total size of stolen information is 1.56TB. |
||||||
| Ransomware | Glenwood Management id12395 View details | United States | Services | pending | ||
|
Glenwood Management is a property management company, providing luxury apartments throughout New York. The total size of stolen information is 1.78TB. |
||||||
| Ransomware | College Park Industries id12394 View details | United States | Education | pending | ||
|
College Park Industries is a is a prosthetics manufacturing company. It design and manufacture a full line of anatomically correct, customizable prosthetic foot systems, upper limb solutions, endoskel |
||||||
| Ransomware | Information Integration Experts id12365 View details | United States | IT | pending | ||
|
Information Integration Experts, LLC (iiExperts aka IIX) has been developing software since the early 1970s. Headquartered in Arlington, Texas, IIXbegan operations in 1980, and has been serving the |
||||||
| Ransomware | Erler & Kalinowski id12152 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 1TB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients was also received: |
||||||
| Ransomware | Pedsurology id12145 View details | United States | Healthcare / Pharma | leaked | ||
|
The total size of stolen information is 950 GB This leak contains customer data, corporate information, databases, employees, medical information about customers. |
||||||
| Ransomware | The Blake Law Firm id12144 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 740 GB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients was also receiv |
||||||
| Ransomware | United Equitable Group id12143 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 300GB. This leak contains customer data, corporate information, databases, employee data, and customer insurance. |
||||||
| Ransomware | Allen Blasting and Coating id12142 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 1TB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients was also received: |
||||||
| Ransomware | Semilab id12141 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 1.47TB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients was also receiv |
||||||
| Ransomware | O'Connell Mahon Architects id12140 View details | Ireland | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 1TB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients was also received: |
||||||
| Ransomware | RSH legal id12139 View details | United States | Finance / Legal / Insurance | pending | ||
|
The total size of stolen information is 6 TB. This leak contains corporate information of the company: Financial, legal, information on employees and partners. Information on clients: Personal data of |
||||||