Skip to main content
Darkfield

Operator dossier

Dan0N is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 33 public victims claimed by this operator between April 25, 2024 and August 23, 2024. Dan0N is an emerging ransomware group that first appeared in April 2024, operating with primarily financial motivations and demonstrating a focused targeting approach across multiple sectors. Based on limited public information, the group's origin and affiliations remain unclear, with insufficient data to determine whether they operate as an independent entity or as part of a Ransomware-as-a-Service model. The group has demonstrated capability to compromise organizations across diverse sectors including business services, technology, healthcare, and financial services, though specific attack vectors and technical methodologies have not been extensively documented by major security research organizations. Dan0N has maintained a relatively low profile compared to established ransomware operations, with 33 documented victims primarily concentrated in the United States, Ireland, and South Korea, suggesting either targeted regional focus or opportunistic attacks against accessible infrastructure in these countries. The group appears to remain active as of current reporting, though the limited public documentation from established threat intelligence sources indicates they have not yet achieved the notoriety or scale of operations that would trigger significant law enforcement attention or comprehensive technical analysis from major security firms.

Most-targeted sectors

Most-affected countries

Recent disclosures by Dan0N

All 33 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Dan0N →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Dan0N

33 victims indexed · first seen 2 years ago · last activity 2 years ago

33
Victims indexed
#136 of 364 tracked operators
4m
Active period
Apr 2024 → Aug 2024
3
Countries hit
top United States · 25

At a glance

Status
inactive
First seen
2 years ago
Last activity
2 years ago
Onion sites
2 known endpoints
Primary sector
Business Services · 13 hits

About

Dan0N is an emerging ransomware group that first appeared in April 2024, operating with primarily financial motivations and demonstrating a focused targeting approach across multiple sectors. Based on limited public information, the group's origin and affiliations remain unclear, with insufficient data to determine whether they operate as an independent entity or as part of a Ransomware-as-a-Service model. The group has demonstrated capability to compromise organizations across diverse sectors including business services, technology, healthcare, and financial services, though specific attack vectors and technical methodologies have not been extensively documented by major security research organizations. Dan0N has maintained a relatively low profile compared to established ransomware operations, with 33 documented victims primarily concentrated in the United States, Ireland, and South Korea, suggesting either targeted regional focus or opportunistic attacks against accessible infrastructure in these countries. The group appears to remain active as of current reporting, though the limited public documentation from established threat intelligence sources indicates they have not yet achieved the notoriety or scale of operations that would trigger significant law enforcement attention or comprehensive technical analysis from major security firms.

References

4 links

External sources curated by the MISP threat-intel community.

Timeline

5 months
2024-04-01T00:00:00+00:00 · 82024-05-01T00:00:00+00:00 · 192024-06-01T00:00:00+00:00 · 22024-07-01T00:00:00+00:00 · 12024-08-01T00:00:00+00:00 · 3
2024-04-01T00:00:00+00:002024-08-01T00:00:00+00:00

Top countries

🇺🇸 United States
25
🇮🇪 Ireland
2
🇰🇷 South Korea
1
United States dossier →Ireland dossier →South Korea dossier →

Top sectors

Business Services
13
Technology
7
Healthcare
6
Financial
4
Transportation/Logistics
1
Business Services dossier →Technology dossier →Healthcare dossier →Financial dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionDefense EvasionImpact

Techniques

Recent victims

Loading…

Onion infrastructure

2 known
  • http://2c7nd54guzi6xhjyqrj5kdkrq2ngm2u3e6oy4nfhn3wm3r54ul2utiqd.onion
  • http://2c7nd54guzi6xhjyqrj5kdkrq2ngm2u3e6oy4nfhn3wm3r54ul2utiqd.onion/

Source

Updated 2 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Dan0N posts a victim.

Add Dan0N to your watchlist — Pro pings you within 5 minutes of any new Dan0N leak-site post, Telegram callout, or affiliate-rebrand inference.