darkangels

Executive Summary

Dark Angles is a medium-sophistication cybercriminal group specializing in highly selective ransomware attacks targeting large enterprises. They are known for their ability to exfiltrate massive amounts of data (up to 100 TB per victim) and have successfully negotiated the largest single ransom payment ($75 million) from a Fortune 50 company in early 2024. Their operational focus on high-value targets suggests they prioritize organizational gain through lucrative ransom demands.

Goals & Targeting

Dark Angles' primary objectives are financial gain through ransom payments and organizational disruption. They target large enterprises, particularly those in sectors like manufacturing, technology, and finance, where data value is high and recovery costs are significant. Their targeting strategy appears to prioritize both the ability to pay a large ransom and the potential political or reputational impact of a breach. The group's focus on a limited number of high-value targets reflects their criminal business model aimed at maximizing returns with minimal exposure.

Dark Angles is a sophisticated ransomware group that emerged in April 2022 and has since targeted highly valuable enterprises, including Johnson Controls and a Fortune 50 company. Unlike many other ransomware groups, Dark Angles operates with a high degree of selectivity, focusing on large corporations rather than indiscriminate attacks. Their modus operandi involves extensive data exfiltration prior to deploying ransomware, which not only increases the pressure on victims but also demonstrates their technical capabilities. The group is known for its professionalism in negotiation and has achieved significant financial gains through their operations. Dark Angles' focus on high-value targets indicates a strategic approach to maximizing returns while minimizing operational risks. Their activities represent a growing trend of cybercriminal groups prioritizing quality over quantity in their victim selection, aligning with the broader evolution of ransomware tactics.

Key Capabilities

• Highly selective targeting of large enterprises
• Massive data exfiltration (up to 100 TB)
• Professional negotiation for ransom payments
• Advanced persistent threat (APT) tactics for data theft
• Ransomware deployment for financial gain

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Dark Angles has been highly active in early 2024, with a notable campaign against a Fortune 50 company resulting in $75 million ransom payment. They appear to operate with a slower operational tempo compared to volume-focused groups but compensate by targeting higher-value victims. Their campaigns are characterized by thorough data exfiltration prior to ransomware deployment, demonstrating their focus on maximizing damage and negotiate power. Past operations include attacks on Johnson Controls and other high-profile enterprises in the manufacturing sector.

IOC Patterns

• Exfiltration of massive volumes of data (100 TB+)
• Ransomware payload delivery via encrypted C2 communication
• Lateral movement within corporate networks using SMB/RDP protocols
• Data staging for exfiltration using cloud storage or web-based tools
• Use of custom ransomware with encryption capabilities

Recommended Actions

• Implement endpoint detection and response (EDR) solutions to identify malicious processes related to known ransomware families.
• Enforce multi-factor authentication (MFA) for critical systems and data repositories.
• Conduct regular backups and ensure they are stored offline and encrypted.
• Monitor network traffic for异常加密通信 or unusual patterns indicating exfiltration activity.
• Train employees to recognize phishing attempts and suspicious emails, as these may be used as entry vectors.
• Segment networks to limit lateral movement opportunities for attackers.
• Deploy anti-malware solutions capable of detecting custom ransomware variants.
• Establish a formal incident response plan with specific procedures for responding to ransomware attacks.

Suggested Tags