Dark Angels

Dark Angels, a threat actor group with malicious intent, has emerged as a significant cybersecurity concern since its first appearance in May 2022. Known for their ransomware attacks, the group has been involved in several high-profile cybercrimes, targeting large corporations and stealing vast amounts of data. They have notably claimed the theft of 1TB of data from chipmaker Nexperia. In addition to data theft, Dark Angels have also targeted companies such as Johnson Controls and global food distribution firm Sysco, causing substantial disruption and financial loss. In February 2024, Dark Angels received unprecedented attention when they reportedly received a record-breaking $75 million ransom payment from an unidentified Fortune 50 company, possibly pharmaceutical giant Cencora. This marked the largest single ransom payment ever recorded, highlighting the increasing severity and financial implications of the group's activities. Despite their reluctance to deploy ransomware malware due to the potential business disruption it causes, this event demonstrated their capacity for high-stakes extortion. The Dark Angels' modus operandi includes publishing stolen data from victims who refuse to pay the demanded ransom, thereby adding reputational damage to the financial impact. Notable instances include the attack on travel booking giant Sabre in September 2023, where customer data was exposed following a ransomware attack. The rising threat posed by Dark Angels underscores the urgent need for robust cybersecurity measures and proactive response strategies to mitigate the risk and impact of such attacks.