desolator

Executive Summary

Desolator is a medium-sophistication ransomware group that emerged in August 2025. They primarily target construction, engineering firms in Latin America and Europe, and technology companies in Asia. Their operations include recruiting affiliates from dark web forums to expand their attack capabilities.

Goals & Targeting

Desolator's strategic objectives are centered around financial gain through ransomware activities. They target sectors with potentially higher vulnerabilities or weaker security postures, such as construction and engineering firms in Latin America and Europe, as well as technology companies in Asia. Their targeting strategy implies a focus on regions where they may find easier entry points or less sophisticated defenses, allowing them to maximize their attack success rate.

Desolator operates as a criminal threat group with a focus on organizational gain through ransomware activities and financial profit. This group emerged in May 2025 and has been observed targeting specific sectors across multiple regions. Their use of an affiliate program, recruiting individuals such as penetration testers, initial access brokers, and social engineers from dark web forums, indicates a strategic approach to expanding their operational capabilities. While Desolator is relatively new, their quick recruitment efforts suggest potential scalability in their attack campaigns.

Key Capabilities

• Ransomware deployment
• Affiliate recruitment through dark web forums
• Coordination with initial access brokers
• Social engineering campaigns

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Desolator's campaigns have started recently, with limited known victims as of now. Their operational tempo is likely to increase as their affiliate program grows. They target specific sectors and regions, indicating a strategic focus on industries that may offer higher financial returns.

IOC Patterns

• Encrypted files with .desolator extensions
• Phishing emails with malicious attachments or links
• C2 traffic via domains associated with targeted regions

Recommended Actions

• Enhance email security to detect phishing attempts
• Monitor network traffic for unusual activities
• Implement regular data backups
• Use decoy systems (honeypots) to detect malicious activity

Suggested Tags