Active ransomware operator

DARK VAULT

aka darkvault · 0 victims indexed

Victims indexed

—

Active period

—

Countries hit

At a glance

Status: active
Aliases: darkvault
First seen: —
Last activity: —
Onion sites: 3 known endpoints

References

4 links

External sources curated by the MISP threat-intel community.

ransomlook.io/group/darkvault
watchguard.com/wgrd-security-hub/ransomware-tracker/dark-vault
threatintelligence.com/blog/darkvault-ransomware
dig.watch/updates/darkvaults-slip-up-exposes-link-to-lockbit

Recent victims

Loading…

Onion infrastructure

3 known

http://5vphklgizbimeq5l4yt274p533fgirhqnjhjuppcp2ibteavmro5fzad.onion
http://mdhby62yvvg6sd5jmx5gsyucs7ynb5j45lvvdh4dsymg43puitu7tfid.onion
http://tx23pk4zw5qynq3tmfk2jz5zbel63p4nwvkheswze7r6gzxhzcbseyad.onion

Source

Updated recently

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Operator dossier

At a glance

References

Recent victims

Onion infrastructure

Source