Skip to content
brandefense.io
Request A Demo
RansomwareUnknown

Onyx

Onyx is a ransomware group, tracked by Brandefense. It targets organisations in Brazil and Mexico.

Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

Who They Target.

Countries · 2

About Onyx.

Onyx is a ransomware group first observed in April 2022, based on the Chaos ransomware builder, that is notably destructive, files larger than 2MB are overwritten with random data rather than encrypted, making recovery impossible even after ransom payment, claiming approximately 13 victims across six countries.

Last updated Sep 29, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.