Donex

DoNex is a form of malware, specifically ransomware, known for its harmful effects on computer systems and data. This malicious software infiltrates systems often through suspicious downloads, emails, or websites, subsequently stealing personal information, disrupting operations, or holding data hostage for ransom. DoNex typically targets data sources that store administrative files like PDFs and document scans containing sensitive information, thereby intensifying the pressure on victims. During its operation, DoNex was found to be running a data leak site on TOR, listing five victims in Europe and North America. The security company Avast released a decryptor for DoNex Ransomware and its predecessors, providing some relief for affected users. The origins and affiliations of DoNex are not entirely clear, but there are suggestions it may have been rebranded from other forms of ransomware. One such candidate is Darkrace, a LockBit variant that first surfaced in August 2023. There's also a possibility that Helldown, another malware strain, is a rebrand of Donex, according to cybersecurity firm Sekoia. Sekoia also notes that Helldown's tactics and code share similarities with other ransomware strains, including Darkrace and Donex, both linked to the LockBit 3.0 lineage. Despite these links, it remains unclear whether the same developer or operators are behind Muse, DarkRace, or DoNex. Other new operators include groups using names like Space Bears, Rabbit Hole, Qiulong, DoNex, and Arcus Media. Understanding the relationships between these various strains and operators is crucial in developing effective countermeasures against these pervasive threats.