Donex

DoNex is a type of malware, specifically ransomware, that infiltrates systems to exploit and damage them, often without the user's knowledge. It operates by encrypting user data and then demanding a ransom for its decryption. In addition to this, DoNex was found to operate a data leak site on TOR, listing at least five victims from Europe and North America. The ransom note dropped by the ransomware included instructions for victims to contact the threat actors via a TOR site, TOX chat, or email. A noteworthy discovery during research into DoNex is its potential connection to another ransomware named DarkRace. DarkRace, which appeared in mid-2023, was found to have a very similar ransom note and configuration file to DoNex, suggesting a possible shared origin. However, it remains unclear whether the same developer or operators are behind both DoNex and DarkRace, as well as other ransomware groups such as Muse, Space Bears, Rabbit Hole, Qiulong, and Arcus Media. In response to the threat posed by DoNex and its predecessors, Avast, a global leader in digital security products, released a decryptor tool. This tool allows users infected with DoNex or related ransomware to decrypt their files without paying the ransom. The release of this decryptor represents a significant step in combating the threat posed by these malicious software variants.