Ransomware Group intelligence
Darkangels
ActiveTrack Darkangels with 0 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Darkangels is tracked by Breach House as a ransomware group with 0 published victims.
The group is tracked across multiple victim records in the Breach House dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 8h ago | wemo2ysyeq6km2nqhcrz63dkdhez3j25yw2nvn7xba2z4h7v7gyrfgid.onion |
Top Activity Sectors
No sector intelligence available.
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Darkangels, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: darkangels uses PowerShell scripts to execute malicious commands and deploy payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: darkangels disables security tools like antivirus software and monitoring agents to evade detection and persistence.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: darkangels deletes Volume Shadow Copies and backup directories via command-line tools to prevent data recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1049 System Network Connections Discovery Discovery
What they do: darkangels queries system network connections to identify active services and potential exfiltration or C2 targets.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1135 Network Share Discovery Discovery
What they do: darkangels performs network share discovery to identify accessible SMB shares for lateral movement and data targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: darkangels leverages SMB/Windows Admin Shares for lateral movement across networked hosts within the victim environment.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: darkangels encrypts victim files using strong symmetric encryption to maximize impact and pressure victims into payment.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: darkangels runs system recovery inhibition commands to prevent automated restoration processes from mitigating encrypted systems.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Crypto Wallets (1)
▼
$1,514,101
Received (USD)
2
Payments
1
Known wallets
$1,514,096
Largest single payment
2022-05-04 → 2022-05-04
Payment window
bitcoin · 1
| Address | Chain | Received (USD) | Payments |
|---|---|---|---|
bc1q0wf73xmcqkvrvs7tj49hznxqqgt6tp359gk0az |
bitcoin | $1,514,101 | 2 |
Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
darkangels.txt
-------------------------------------------------------------------------- HELLO dear Management of [snip] If you are reading this message, it means that: - your network infrastructure has been compromised, - critical data was leaked, - files are encrypted, - backups are deleted ------------------------------------------------------ by D A R K A N G E L S T E A M The best and only thing you can do is to contact us to settle the matter before any losses occurs. 1. THE FOLLOWING IS STRICTLY FORBIDDEN 1.1 EDITING FILES ON HDD. Renaming, copying or moving any files could DAMAGE the cipher and decryption will be impossible. 1.2 USING THIRD-PARTY SOFTWARE. Trying to recover with any software can also break the cipher and file recovery will become a problem. 1.3 SHUTDOWN OR RESTART THE PC. Boot and recovery errors can also damage the cipher. Sorry about that, but doing so is entirely at your own risk. 1.4 HIRING THE EUROPOL AND OTHERS Cooperating with the EUROPOL, INTERPOL and so on and involving their officers in negotiations will end our communication with you and we will share all the leaked data for free. -------------------------------------------------------------------------------------------------- 2. EXPLANATION OF THE SITUATION 2.1 HOW DID THIS HAPPEN The security of your IT perimeter has been compromised (it's not perfect at all). We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks. We spent a lot of time researching and finding out the most important directories of your business, your weak points. So, we has DOWNLOADED about 2.5TB ( 2 500 GBs) of your most SENSITIVE Data just in case if you will NOT PAY, than everything will be PUBLISHED in Media, hacking forums(China, Ukraine, Russia etc) and/or SOLD to any third-party. 2.2 "WE HAS COLLECTED SUCH DATA AS: - Project Files and Drawings(CAD files, Manuals, concept, Konstruktion_MBAU, *.vsd, *.stp, *.dwg, *.odg, *.dws, *.dwt, *.dfx, *.swg, *.ipt, *.iam, *.cdr, *.SLDDRW, *.SLDPRT, *.SLDASM, *.SKP, *.STEP, *.igs, *.iges, *.STL ) - Forschung, HW-Allgemein, Konstruktion_MBAU, Programme, Leittechnik etc - Oracle Production DB from SRHW8226 SRHW8239 - MSSQL Production DB from SRHW8042, SRHW8144 etc - PII - Personal Identification Information - HR files, Accountant files - Most importants files from SRHW8100(srv003) and other FileServers - Emails and working files of top management and many employees(about 45 PST files) - Geheimhaltungsvereinbarung(NDA), Patents, Secret and Confidential infromation - Customer and partner files, including correspondence and many many more. 2.3 TO DO LIST (best practies) - Contact us as soon as possible. - Contact us only in our live chat, otherwise you can run into scammers. - Purchase our decryption tool and decrypt your files. There is no other way to do this. - Realize that dealing with us is the shortest way to success and secrecy. - Give up the idea of using decryption help programs, otherwise you will destroy the system permanently. - Avoid any third-party negotiators and recovery groups. They can become the source of leaks. 3. POSSIBLE DECISIONS 3.1 NOT MAKING THE DEAL - After 4 days starting tomorrow your leaked data will be Disclosed or sold. - We will also send the data to all interested supervisory organizations and the media. - Decryption key will be deleted permanently and recovery will be impossible. - Losses from the situation can be measured based on your annual budget. 3.2 MAKING THE WIN-WIN DEAL - You will get the only working Decryption Tool and the how-to-use Manual. - You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data. - You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet. - You will get our security report on how to fix your security breaches. - You will get our Advanced Penetration Test Report about your security. - We guarantee the removal of all backdoors in your network 4. EVIDENCE OF THE LEAKAGE https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] https://ibb.co/[snip] 5. HOW TO CONTACT US 5.1 Download and install TOR Browser https://torproject.org 5.2 Go to our live-chat website at https://wemo2ysyeq6km2nqhcrz63dkdhez3j25yw2nvn7xba2z4h7v7gyrfgid.onion/page/[snip] 5.3 You can request additional Proof Pack with your data in our live chat to review. 5.4 In case TOR Browser is restricted in your area use VPN services. 5.5 All leaked Data will be Disclosed in 4 Days if you remain silent. 5.6 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed. 5.7 Your Data will immediately Disclosed if you will hire third-party negotiators to contact us. 6. RESPONSIBILITY 6.1 Breaking critical points of this offer will cause: - Deletion of your decryption keys. - Immediate sale or complete Disclosure of your leaked data. - Notification of government supervision agencies, your competitors and clients.
[rand].README.txt
-------------------------------------------------------------------------- HELLO dear Management If you are reading this message, it means that: - your network infrastructure has been compromised, - critical data was leaked, - files are encrypted, - backups are deleted ------------------------------------------------------ by D A R K A N G E L S T E A M The best and only thing you can do is to contact us to settle the matter before any losses occurs. 1. THE FOLLOWING IS STRICTLY FORBIDDEN 1.1 EDITING FILES ON HDD. Renaming, copying or moving any files could DAMAGE the cipher and decryption will be impossible. 1.2 USING THIRD-PARTY SOFTWARE. Trying to recover with any software can also break the cipher and file recovery will become a problem. 1.3 SHUTDOWN OR RESTART THE PC. Boot and recovery errors can also damage the cipher. Sorry about that, but doing so is entirely at your own risk. 2. TO DO LIST (best practies) - Contact us as soon as possible. - Contact us only in our live chat, otherwise you can run into scammers. - Purchase our decryption tool and decrypt your files. There is no other way to do this. - Realize that dealing with us is the shortest way to success and secrecy. - Give up the idea of using decryption help programs, otherwise you will destroy the system permanently. - Avoid any third-party negotiators and recovery groups. They can become the source of leaks. 3. POSSIBLE DECISIONS 3.1 NOT MAKING THE DEAL - After 4 days starting tomorrow your leaked data will be Disclosed or sold. - We will also send the data to all interested supervisory organizations and the media. - Decryption key will be deleted permanently and recovery will be impossible. - Losses from the situation can be measured based on your annual budget. 3.2 MAKING THE WIN-WIN DEAL - You will get the only working Decryption Tool and the how-to-use Manual. - You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data. - You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet. - You will get our security report on how to fix your security breaches. - You will get our Advanced Penetration Test Report about your security. - We guarantee the removal of all backdoors in your network 4. HOW TO CONTACT US 4.1 Download and install TOX or Session TOX Download Link:https://tox.chat/download.html Session Download Link:https://getsession.org/ 4.2 Add Us on Tox or Session: Tox ID:EB66AAB860C618A4998118BC352BED9C9537EB3D7AC9BE1FFE548F68D921BB51A14BB177D99A Session ID:056645f3ef148be3d6b782581cfd89100b8287d20cb13a9ad02f34982930d36346 Backup Email: [email protected] [email protected] 4.3 You id is [snip] 4.4 In case network is restricted in your area use VPN services. 4.5 All leaked Data will be Disclosed in 4 Days if you remain silent.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (0)
Search, filter and paginate the victim timeline for Darkangels.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|
No victims found for the selected filters.