Dark Angels is a highly selective ransomware group targeting large enterprises with massive data exfiltration since 2022.
Dark Angels is a highly selective ransomware group active since April 2022, targeting a small number of large enterprises including Fortune 50 companies. Their primary TTPs involve massive data exfiltration up to 100 TB per victim and ransom demands, securing a record $75 million payment in 2024. Defenders should prioritize robust data loss prevention (DLP) controls and strict network segmentation to detect and limit large-scale data egress.
Dark Angels is a highly selective ransomware group active since April 2022 that targets a small number of large enterprises — including Johnson Controls — exfiltrating up to 100 TB of data per victim, and secured the largest known single ransom payment of $75 million from a Fortune 50 company in early 2024.
Dark Angels exfiltrates up to 100 TB of data per victim.
Defenders should prioritize robust data loss prevention (DLP) controls and strict network segmentation.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.