Skip to content
brandefense.io
Request A Demo
RansomwareUnknown

Dark Angels

Dark Angels is a ransomware group, tracked by Brandefense. It targets 3 sectors, including Technology and Finance, in 3 countries, including the United States and Brazil.

Also known as
  • Darkangel
  • Dunghill Leak
  • Dunghill
Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
First seen
Apr 1, 2023
Last seen
Jul 1, 2025
Record updated

Who They Target.

Sectors · 3
Countries · 3

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →
CVE-2021-26855Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.ExploitedcriticalCVE-2023-38831RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.Exploitedhigh

Arsenal · Malware And Tools.

  • Babukmalware
  • Dark Angelsmalware
  • Dunghillmalware
  • Dunghill Ransomwaremalware

Indicators Of Compromise.

TLP:AMBER

3 indicators on the Brandefense platform

IP, domain and hash indicators · YARA rules · ATT&CK Navigator export

Request A Demo

About Dark Angels.

Dunghill Leak is the data extortion site operated by the Dark Angels ransomware group, active since early 2023, targeting large enterprises across healthcare, finance, industrial, and technology sectors using a highly selective non-affiliate model, and responsible for a record-breaking $75 million ransom payment in 2024.

Last updated Nov 10, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.