Skip to main content
Darkfield

Operator dossier

Darkleakmarket is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 39 public victims claimed by this operator between September 9, 2021 and May 25, 2022. Darkleakmarket is a financially motivated ransomware group that emerged in September 2021, primarily targeting organizations in the United States across finance, healthcare, technology, and energy sectors. The group has claimed responsibility for attacks against 39 known victims, though specific details about their country of origin and potential affiliations with other cybercriminal organizations remain undocumented in public threat intelligence reports. Limited public information exists regarding their specific attack methodologies, initial access vectors, or whether they employ double extortion tactics involving data theft prior to encryption. No major high-profile campaigns or significant law enforcement actions against Darkleakmarket have been publicly documented by major security agencies or researchers. The current operational status of this group remains unclear due to the limited public reporting and intelligence available about their activities since their initial emergence.

Most-targeted sectors

Most-affected countries

Recent disclosures by Darkleakmarket

All 39 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Darkleakmarket →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Darkleakmarket

39 victims indexed · first seen 5 years ago · last activity 4 years ago

39
Victims indexed
#122 of 364 tracked operators
8m
Active period
Sep 2021 → May 2022
1
Countries hit
top United States · 3

At a glance

Status
inactive
First seen
5 years ago
Last activity
4 years ago
Onion sites
5 known endpoints
Primary sector
Finance · 3 hits

About

Darkleakmarket is a financially motivated ransomware group that emerged in September 2021, primarily targeting organizations in the United States across finance, healthcare, technology, and energy sectors. The group has claimed responsibility for attacks against 39 known victims, though specific details about their country of origin and potential affiliations with other cybercriminal organizations remain undocumented in public threat intelligence reports. Limited public information exists regarding their specific attack methodologies, initial access vectors, or whether they employ double extortion tactics involving data theft prior to encryption. No major high-profile campaigns or significant law enforcement actions against Darkleakmarket have been publicly documented by major security agencies or researchers. The current operational status of this group remains unclear due to the limited public reporting and intelligence available about their activities since their initial emergence.

Timeline

4 months
2021-09-01T00:00:00+00:00 · 272021-10-01T00:00:00+00:00 · 32022-04-01T00:00:00+00:00 · 72022-05-01T00:00:00+00:00 · 2
2021-09-01T00:00:00+00:002022-05-01T00:00:00+00:00

Top countries

🇺🇸 United States
3
United States dossier →

Top sectors

Finance
3
Healthcare
1
Technology
1
Energy
1
Finance dossier →Healthcare dossier →Technology dossier →Energy dossier →

MITRE ATT&CK

6 techniques · 6 tactics

Tactics

Initial AccessExecutionDefense EvasionCollectionExfiltrationImpact

Techniques

Recent victims

Loading…

Onion infrastructure

5 known
  • http://54rdhzjzc4ids4u4wata4zr4ywfon5wpz2ml4q3avelgadpvmdal2vqd.onion
  • http://54rdhzjzc4ids4u4wata4zr4ywfon5wpz2ml4q3avelgadpvmdal2vqd.onion/
  • http://aby6efzmp7jzbwgidgqc6ghxi2vwpo6d7eaood5xuoxutrfofsmzcjqd.onion
  • http://darkleakyqmv62eweqwy4dnhaijg4m4dkburo73pzuqfdumcntqdokyd.onion
  • http://darklmmmfuonklpy6s3tmvk5mrcdi7iapaw6eka45esmoryiiuug6aid.onion

Source

Updated 4 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Darkleakmarket posts a victim.

Add Darkleakmarket to your watchlist — Pro pings you within 5 minutes of any new Darkleakmarket leak-site post, Telegram callout, or affiliate-rebrand inference.