Darkangel
- First seen
- 2022-03-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:49:19
Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications
Context
Dark Angels is a highly targeted ransomware and data-extortion group that emerged in spring 2022. Rather than using an affiliate-driven model, it orchestrates discreet, high-impact attacks on large organizations—often choosing one Fortune-level victim at a time. The group exfiltrates massive volumes of data (sometimes 10–100 TB), optionally deploys encryption on Windows or ESXi systems, and pressures victims via a Tor-hosted leak platform ("Dunghill Leak"). Their notable incidents include extorting a record $75 million from a Fortune 50 company in 2024 and demanding around $51 million from Johnson Controls. Dark Angels’ operations emphasize stealth and precision over disruption, often avoiding high-profile media exposure and operating with low operational visibility.
Reports & references
- ransomlook.io — Darkangel (report)
- zscaler.com — Shining Light Dark Angels Ransomware Group (report)
- isaca.org — Darkangels Strikes Big Record Breaking Ransom Secured (report)
- sentinelone.com — Dark Angels Team Ransomware (report)
- krebsonsecurity.com — Low Drama Dark Angels Reap Record Ransoms (report)
- mphasis.com — Dark Angels Ransomware Apr28 22 5 (report)