Dunghill

Dunghill is a threat actor, also known as a hacking group, that has been active since early 2023 according to WatchGuard. The group operates under the umbrella of the Dark Angels ransomware group, which itself has been active since May 2022. Dunghill is notorious for its malicious activities involving ransomware attacks and data leaks. It is believed to be responsible for several high-profile breaches, including one involving Johnson Controls in the previous year. Last month, Dunghill was implicated in two major cybersecurity incidents. The Michigan-based technology company Gentex Corporation disclosed a breach by the Dunghill ransomware gang, leading to significant data loss. Simultaneously, technology distributor ScanSource confirmed that a ransomware attack, presumably from Dunghill, caused multiday system outages. In a more recent development, Dunghill claimed on its data leak site, 'Dunghill Leaks,' to have stolen 1TB of data from Nexperia, threatening to publish the remaining data if their ransom demand is not met. The Dark Angels launched the 'Dunghill Leaks' site in April 2023, using it as a tool to extort victims by threatening to leak sensitive data if ransoms are not paid. As noted by Alex Delamotte, a senior threat researcher at SentinelOne, the ransom notes often contain an onion link to the Dunghill Leaks site. However, despite the threats, there is currently no data attributed to Johnson Controls visible on the Dunghill Leaks site. The continued activity of Dunghill underscores the persistent and evolving threat posed by such cybercriminal groups.