Donex

Donex is an emerging ransomware group first observed in March 2024 that appears to be financially motivated, having claimed five documented victims in its initial months of operation. The group's origin and affiliations remain unclear due to limited public documentation by major security researchers, though their targeting patterns suggest a relatively small-scale operation compared to established ransomware families. Donex has demonstrated a preference for targeting technology and transportation/logistics sectors, with documented attacks spanning multiple continents including victims in Italy, Czech Republic, United States, Netherlands, and Belgium, indicating either a broad opportunistic approach or the use of initial access brokers with diverse geographic reach. The group has also shown interest in agriculture and food production entities, though specific attack methodologies, encryption techniques, and extortion tactics have not been publicly documented by major threat intelligence firms. Given the group's recent emergence in early 2024 and limited public reporting, Donex appears to remain active but operates at a significantly smaller scale than major ransomware families, with insufficient public documentation to determine their current operational status or any law enforcement disruption efforts.