D0nut
D0nut is a ransomware group with a financial motive, tracked by Brandefense. It targets the Technology and Healthcare sectors in the United States and the United Kingdom.
Also known as
- Donut Leaks
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Mar 8, 2024
- Last seen
- Nov 29, 2024
- Record updated
Who They Target.
Sectors · 2
Countries · 2
Labelsd0nutransomware
About D0nut.
Donut Leaks (D0nut) is a data-extortion group active since August 2022 that developed its own ransomware encryptor, linked to attacks on Greece's DESFA gas company and Continental, believed to be an affiliate of multiple RaaS operations who pivoted to running an independent extortion platform.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.