Dunghill Leak

The Dunghill Leak is a relatively new ransomware and extortion group that emerged from the Dark Angels ransomware, which itself originated from the Babuk ransomware. It first came to light in April 2023 when the Dark Angels launched their victim shaming site called Dunghill Leak. This platform, although not particularly well-branded, was used to disclose their attacks and shame their victims. Some of the notable victims listed on the site include global food distribution firm Sysco, which experienced a ransomware attack in May 2023, and travel booking giant Sabre, targeted by the Dark Angels in September 2023. Dunghill Leak has claimed responsibility for several high-profile cyberattacks, including those against coin-operated game maker Incredible Technologies, food giant Sysco, and automotive products maker Gentex. The group alleges to have stolen large amounts of data during these attacks. For example, they claim to have accessed about 500 GB of data from one company, including game files and tax payment reports, and approximately 1.3 terabytes of data from another, encompassing databases on ticket sales, passenger turnover, employees' personal data, and corporate financial information. Despite its activities, little is known about Dunghill Leak. Researchers believe that it is essentially a rebranded version of the Dark Angels, continuing the latter's legacy of cyber extortion. As of now, the group continues to operate, making headlines with its attacks on major corporations and leaking sensitive data on its dark web site. Security researchers are closely monitoring its activities to understand its tactics, techniques, and procedures better, and develop effective countermeasures.