Ransomware Group intelligence
Darkrace
InactiveTrack Darkrace with 10 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Darkrace is tracked by Breach House as a ransomware group with 10 published victims.
Portugal is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Down checked 1h ago | wkrlpub5k52rjigwxfm6m7ogid55kamgc5azxlq7zjgaopv33tgx2sqd.onion |
Top Activity Sectors (4)
Typical Attacks (8)
▼MITRE ATT&CK does not currently catalogue Darkrace, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: darkrace executes PowerShell scripts to stage initial compromise and payload deployment across targeted systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: darkrace modifies registry run keys to ensure persistence of malicious execution after reboot.
What that means: Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: darkrace disables antivirus tools and security software to prevent detection and mitigation during encryption.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: darkrace performs targeted file deletion to remove backups, logs, and shadow copies before encryption.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1057 Process Discovery Discovery
What they do: darkrace uses process discovery to identify active services and processes for selective disruption or evasion.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: darkrace leverages SMB/Windows Admin Shares for lateral movement between networked hosts in manufacturing and IT environments.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: darkrace encrypts victim files using a custom ransomware payload to maximize data impact and extortion leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: darkrace calls system recovery inhibitors to block restoration attempts and solidify impact.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (10)
Search, filter and paginate the victim timeline for Darkrace. Showing 1–10 of 10.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | marstrand.se id6791 View details | Sweden | Communication / Marketing | ||
|
Längst ut i väster, där skärgården tar slut och havet tar vid, ligger Marstrand. Seglarstaden och badorten Marstrand är inte utan anledning en storfavorit för alla besökare. Här finns kajen med båtar av alla slag, mysiga hus vid bilfria gator, topprestauranger och caféer, sol och salta bad, musik och skådespel. På toppen av ön tronar Carlstens fästning. Efter en kort färjetur över sundet befinner du dig på själva Marstrandsön, med en levande närvaro från en svunnen tid, blandat med trendiga seglarjackor. På Marstrand finner man både krogliv och stilla lugn beroende på när man besöker ön. Med sina mysiga kvarter, små gränder och prång, sin dominerande fästning och havsutsikt vart man än vänder sig, väcker ön starka känslor. Längs bryggorna i Sveriges största gästhamn ligger båtarna tätt och med GKSS Match Cup Sweden första veckan i juli är Marstrand definitivt seglingens huvudstad i Sverige. |
|||||
| Ransomware | COOPERATIVETECH id6778 View details | IT | |||
|
Cooperative Technologies delivers proven, industry specific standards-based software that helps organizations cut operational overhead costs and improve customer service. Platform-independent customizable software solutions keep carriers in charge of their funds, reducing risk while staying on top of industry trends. Insurance and financial carriers depend upon our list bill reconciliation and 1035 exchange solutions. |
|||||
| Ransomware | vaud-promotion id6777 View details | Switzerland | Communication / Marketing | ||
|
L’Association Vaud Promotion a pour but d’accroître la notoriété, la compétitivité et l’attractivité du canton de Vaud au moyen de la marque VAUD+ dont elle promeut les valeurs. Elle entend réaliser son but en collaboration avec les acteurs économiques, régions et institutions participant à la promotion du canton de Vaud, à travers les activités, produits et services qui en font le succès, qu’ils soient économiques, académiques, touristiques, culturels, sportifs, issus du terroir vaudois et gastronomiques.A cet effet, elle anime une communauté d’acteurs multisectoriels vaudois qui incarnent et véhiculent les valeurs de la marque VAUD+. |
|||||
| Ransomware | PICPLUS.COM id6745 View details | Communication / Marketing | |||
|
Pictures Plus and O'Roke Photography have over 50 years of combined experience providing School, Sports, Event & Portrait photography services in the Quad-State area. We are members of the PSPA (Professional School Photographers Association) as well as PMA (Photo Marketing Associates) and have a long history of community involvement and support. We have designed a hassle-free picture day, providing multiple photography stations to make your day run faster. We are staffed with trained and qualified personnel to ensure accuracy, quality and efficiency leading up to and on picture day. Our Customer Service cares about each and every customer. We stand by our friendly, home-town service and 100% Satisfaction Guarantee. |
|||||
| Ransomware | rzepeckimroczkowski id6732 View details | Poland | Communication / Marketing | ||
|
Rzepecki Mroczkowski Sp. Z o.o. - z grupą Volkswagen związani jesteśmy od 1991, jako autoryzowany dealer marki Volkswagen oraz Volkswagen Samochody Dostawcze. Siedziba Spółki zlokalizowana jest w Poznaniu przy ulicy Wiatracznej 5. W tej samej lokalizacji prowadzimy również autoryzowany serwis i sprzedaż oryginalnych części zamiennych dla marek: Volkswagen, Volkswagen Samochody Dostawcze, Audi oraz Skoda. |
|||||
| Ransomware | hep global GmbH id6723 View details | Japan | Energy | ||
|
A partner for everything to do with solar energy. That’s hep. Since 2008. We develop, build, operate and finance solar parks. World-wide. For energy production that can do more than supply electricity. The large-scale photovoltaic facilities we have developed have a capacity of around 1,310 MW peak. From our sites in Germany, Japan and the USA we operate 18 solar projects ourselves. Our active pipeline for future projects comprises around 5,300 MW peak. (The number of solar parks in operation are up to date. All the other figures are updated every six months.) |
|||||
| Ransomware | PLURISERVICE id6722 View details | Italy | Communication / Marketing | ||
|
Pluriservice Spa nasce nel 1986, è leader nel settore Auto ID (codice a barre). Produce e commercializza un’ampia gamma di prodotti tecnologicamente avanzati e innovativi. È distributore in esclusiva per il territorio nazionale di alcuni dei brand più riconosciuti a livello mondiale nel settore Auto ID. È proprietaria dei brand PLUS e APIX e produce soluzioni software con Storm Open Solutions, la software house nata nel 2001, depositaria nello sviluppo e rinnovo delle suite E2K per i settori hospitality e retail, con oltre 5000 clienti attivi. Pluriservice Solutions è il system integrator del gruppo che nel 2006 ha raggiunto 6 Mln di fatturato con i contratti di locazione attivi. Raining Labels nasce nel 2005 e si occupa di realizzare etichette adesive standard e personalizzate, ad oggi ha realizzato oltre 5 milioni di m2 di etichette. La Proget Sistem Italia è dedicata alla progettazione e ingegnerizzazione dei sistemi di etichettatura e stampa. |
|||||
| Ransomware | PESSI id6718 View details | Communication / Marketing | |||
|
PESSI is committed to provide services and benefits to workers and their dependents in close partnership with the employers. By bringing transparency and ensuring fairness to its business processes, PESSI's noble task of providing comprehensive medical coverage and a number of cash benefits to its secured clientele comprising of downtrodden workers and their dependents including parents is expected to significantly enhance the coverage and scope of its services. PESSI is indeed a partner in enhancing productivity of businesses by providing security and peace of mind to workers. May Allah give us strength to standby our commitments. |
|||||
| Ransomware | CONATECO id6704 View details | Communication / Marketing | |||
|
CO.NA.TE.CO. ( Consorzio Napoletano Terminal Containers ), è stato fondato nel 1995. Oggi è il più grande Terminal nel porto di Napoli e il quarto in Italia. La favorevole posizione geografica nel cuore del Mediterraneo, pone il porto di Napoli e, in particolare, il Terminal CO.NA.TE.CO., nel bel mezzo delle rotte commerciali internazionali, in modo da rappresentare uno dei principali collegamenti tra Nord e Sud Europa. |
|||||
| Ransomware | ERT id2 View details | Portugal | Manufacturing / Engineering | ||
|
ERT is a Portuguese multinational company with its core business on the manufacture of automotive interior components. Our headquarters are located in São João da Madeira, at the heart of one Portugal’s automotive industry cluster. |
|||||