ctrlINT What the industry said about every indicator, with the quote

onionmail[.]orgDomain

Reported by 2 independent sources · first reported by Huntress · last reported

Last reported 4 months ago

What the reports say

3 reports, newest first · the exact sentence from each

  1. “It is noteworthy that Darkrace, Donex, and Helldown consistently use eponymous contact addresses through onionmail[.]org, along with communication through the TOX messaging platform.”

    Sekoia.ioVendor
    Helldown Ransomware: An Overview of this Emerging Threat

  2. “…nt, where the Huntress agent was added to the targeted endpoint mid-compromise, and both ransom notes shared the same email  ([email redacted]@onionmail[.]org).”

    HuntressVendor
    Uptick in Bomgar RMM Exploitation

  3. “The email address listed at the end of the ransom note is [email redacted]@onionmail[.]org, which is likely from where the reference to KAWA4096 originated.”

    HuntressVendor
    Kawabunga, Dude, You’ve Been Ransomed!

Indicators reported together

named in the same reports
Copy these 17 indicators · defanged

Also named with it: CVE-2026-1731, CVE-2024-11667, CVE-2024-42057

Thanks — we review every report.

Report a wrong value
What is wrong with onionmail[.]org here?
No account needed. We do not store your IP address.