Ransomware - Dunghill Leak

Dunghill Leak is the data leak site (DLS) for the Dark Angels Team ransomware group. These two entities are often used interchangeably. However, we have split these into two separate entries. The Dunghill Leak entry, observed here, is reserved for the DLS only, and information found herein will be only applicable to the DLS. Thus, all technical information is found in the Dark Angels Team entry. You will find victim information, communication, and extortion techniques in this entry. For all other information, please see the opposing entry.

 According to Analyst1, the DLS began at the same time of inception as the group's operations. However, an alleged victim wasn't posted for a few months after creation, in January 2023. The Dunghill Leak DLS is reserved for those victims that wouldn't negotiate or refused to pay a ransom altogether. Therefore, some of the big names that appeared in the news from this group will be found on the other entry.

The group employs several different extortion tactics to elicit their ill-gotten gains. They perform the typical extortion and ubiquitous double extortion methodologies. We've also observed the operators leak free data on the DLS, ask victims for cyber insurance to seek a higher extortion demand, and communicate with victim clients and employees. They've also unveiled a ransomware attack to the media that was previously unknown.

Aside from their DLS, the run a mirrored Telegram group that distributes victim breach information. Sometimes the Telegram posts come before the DLS posts, and other times it's vice versa.