Dark Angels

Dark Angels, a Russia-based cybercrime syndicate, emerged as a significant threat actor in the cybersecurity landscape since its first appearance in May 2022. Known for stealing substantial amounts of data from major companies across diverse sectors such as healthcare, finance, government, and education, Dark Angels has managed to maintain a relatively low profile despite its impactful activities. The group's operations are characterized by reluctance to deploy ransomware malware, which typically locks up the target’s IT infrastructure causing significant business disruption. Instead, their modus operandi involves large-scale data theft followed by ransom demands. The Dark Angels group has been linked to several high-profile cyberattacks. In one notable instance, they claimed responsibility for the theft of 1TB of data from chipmaker Nexperia. Their reach has extended to other significant entities, including global food distribution firm Sysco, which suffered a ransomware attack in May 2023, and travel booking giant Sabre, targeted by Dark Angels in September 2023. If victims fail to meet their demands, the group follows a common practice among ransom gangs of publishing the stolen data. In terms of financial impact, Dark Angels has set records with their ransom demands. The most striking case occurred in February when they received a $75 million ransom payment, the largest ever recorded, potentially from pharmaceutical giant Cencora. This event underscores the serious implications of the group's activities, highlighting the necessity for robust cybersecurity measures to counteract such threats.