DonexMalware
The ransomware group known as DoNex was first identified in mid-March 2024. According to the data collected, the samples used by the group were compiled in mid-February, suggesting that it is a relatively new operation.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Helldown Ransomware: An Overview of this Emerging Threat“Configuration similarities to Darkrace and Donex suggest a possible rebrand, though no link is confirmed.”
Indicators in its reports
named in the reports above- 0bfe25de8c46834e…2cecbbdcfabfin 1 report
- b83e8ff6d046dcca…f9dae902d012in 1 report
- 67aea3de7ab23b72…d154215ee733in 1 report
- 3e3fad9888856ce1…e93ddd97289ein 1 report
- 2b15e09b98bc2835…9a707e2a23c0in 1 report
- 6ef9a0b6301d7377…9d0a35f394ddin 1 report
- onionmail[.]orgin 1 report
- 7cd7c04c62d2a8b4…17e55c1cafd7in 1 report
- 7731d73e048a3512…db211f0b0872in 1 report
- 2621c5c7e1c12560…8421b4bae8e1in 1 report
- 47635e2cf9d41cab…aee4330d4d19in 1 report
- cb48e4298b216ae5…c6671aa4f8eain 1 report
- 9ab19741ac36e198…eb3d2092c92cin 1 report
- ccd78d3eba6c5395…b04baadd4bfein 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.